![](/screenshots/edc3e124-4c3d-4a6c-bdc0-f7b0c57e4901.png)
zatanka.com
Open in
urlscan Pro
45.32.197.61
Malicious Activity!
Public Scan
Effective URL: https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=fMw99D33xHoyiYtA6Xm4QLs5bXy9oPlveDUe6KGhxnn8dqPVl4cyjXPq...
Submission: On June 14 via automatic, source phishtank
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 28th 2020. Valid for: 3 months.
This is the only time zatanka.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 45.32.197.61 45.32.197.61 | 20473 (AS-CHOOPA) (AS-CHOOPA) | |
1 6 | 193.41.234.21 193.41.234.21 | 16289 (ING-DIREC...) (ING-DIRECT-SPAIN) | |
1 | 52.208.212.211 52.208.212.211 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 3 |
ASN20473 (AS-CHOOPA, US)
PTR: 45.32.197.61.vultr.com
zatanka.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-212-211.eu-west-1.compute.amazonaws.com
ingdirectspain.demdex.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
zatanka.com
zatanka.com |
1 MB |
6 |
ingdirect.es
1 redirects
ing.ingdirect.es |
113 KB |
1 |
demdex.net
ingdirectspain.demdex.net |
|
14 | 3 |
Domain | Requested by | |
---|---|---|
8 | zatanka.com |
zatanka.com
|
6 | ing.ingdirect.es |
1 redirects
zatanka.com
|
1 | ingdirectspain.demdex.net |
zatanka.com
|
14 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
zatanka.com Let's Encrypt Authority X3 |
2020-05-28 - 2020-08-26 |
3 months | crt.sh |
ing.ingdirect.es DigiCert Global CA G2 |
2020-03-28 - 2022-03-29 |
2 years | crt.sh |
*.demdex.net DigiCert SHA2 High Assurance Server CA |
2018-01-09 - 2021-02-12 |
3 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=fMw99D33xHoyiYtA6Xm4QLs5bXy9oPlveDUe6KGhxnn8dqPVl4cyjXPqnpSLEevtFw3pqfSYd9MVzhP3
Frame ID: 157072031884E23B3596F456951C6506
Requests: 13 HTTP requests in this frame
Frame:
https://ingdirectspain.demdex.net/dest5.html?d_nsid=0
Frame ID: 3B6D317A0009F32B15CBFB18CE19096D
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/edc3e124-4c3d-4a6c-bdc0-f7b0c57e4901.png)
Page URL History Show full URLs
- https://zatanka.com/pfm/ Page URL
- https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=fMw99D33xHoyiYtA6Xm4QLs5bXy9oPlveDUe... Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://zatanka.com/pfm/ Page URL
- https://zatanka.com/pfm/Login.php?sslchannel=true&sessionid=fMw99D33xHoyiYtA6Xm4QLs5bXy9oPlveDUe6KGhxnn8dqPVl4cyjXPqnpSLEevtFw3pqfSYd9MVzhP3 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://ing.ingdirect.es/genoma_transactional/cms_files/posglobal/images/login/banner-login_1164x300.jpg HTTP 302
- https://ing.ingdirect.es/genoma_cms_files/posglobal/images/login/banner-login_1164x300.jpg
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
zatanka.com/pfm/ |
204 B 552 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Login.php
zatanka.com/pfm/ |
18 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transactional.css
zatanka.com/pfm/ |
3 MB 419 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logoING.svg
ing.ingdirect.es/pfm/assets/images/svg/ |
33 KB 13 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LogoDNIE-trazado.svg
ing.ingdirect.es/pfm/assets/images/ |
13 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.min.js
ing.ingdirect.es/pfm/cdn/ing.libs.require/1.0.0/ |
16 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-preconditions.js
zatanka.com/pfm/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner-login_1164x300.jpg
ing.ingdirect.es/genoma_cms_files/posglobal/images/login/ Redirect Chain
|
87 KB 87 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transactional.css
zatanka.com/pfm/ |
3 MB 419 KB |
Font
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icono_twyp.svg
ing.ingdirect.es/pfm/assets/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ing-direct-icons.woff
zatanka.com/pfm/ |
206 KB 206 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-preconditions.js
zatanka.com/pfm/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
INGMeWeb-Regular.ttf
zatanka.com/pfm/ |
74 KB 74 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
ingdirectspain.demdex.net/ Frame 3B6D |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate string| locationHref object| loginReleaseVersion undefined| parentURL undefined| urlsAllowed function| requirejs function| require function| define1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
zatanka.com/ | Name: PHPSESSID Value: 3c9ba56aa50e23919c9eb10e5e9ac8df |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ing.ingdirect.es
ingdirectspain.demdex.net
zatanka.com
193.41.234.21
45.32.197.61
52.208.212.211
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
2d0bd238bea24334b756db3ceed592b175cad6ce035c0592e8dbeb45206eea23
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
54c17d0ed3bb11026280e35e61f337431dc74e1f66eb78f445cf65154c0282ae
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
6bec0ba6c0541fe28653fe190e20a9d09a508e530d551e433216a0c317b84a32
9541e3b61498035e6a56f680f53a778c115d911e57df1a04d08a388a8fb41d81
a5c74ae990d5d2b575b740de198718c44c9126a1b06358cc2833dce69c655b4b
c3e32425f9f950c7f4ec3919c6bcd78c82306a6973e30e1ecc59af204605796d
e884d953cdda5800a427856b9c33369f3937a557814f268191691213cfcae9e2