mijnlngincasso.eloerp.eu
Open in
urlscan Pro
95.141.37.100
Malicious Activity!
Public Scan
Effective URL: https://mijnlngincasso.eloerp.eu/
Submission: On March 29 via manual from NL — Scanned from NL
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 29th 2022. Valid for: 3 months.
This is the only time mijnlngincasso.eloerp.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 45.126.58.78 45.126.58.78 | 132647 (IDNIC-PAN...) (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia) | |
4 | 95.141.37.100 95.141.37.100 | 49367 (ASSEFLOW) (ASSEFLOW) | |
1 | 2606:4700::68... 2606:4700::6812:1634 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6810:5714 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2a06:98c1:312... 2a06:98c1:3121::7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 4 |
ASN132647 (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia, ID)
s.id |
ASN49367 (ASSEFLOW, IT)
PTR: cpanel.wesecurehost.com
mijnlngincasso.eloerp.eu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 3152 ka-f.fontawesome.com — Cisco Umbrella Rank: 5770 |
23 KB |
4 |
eloerp.eu
mijnlngincasso.eloerp.eu |
39 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 521 |
47 KB |
1 |
s.id
1 redirects
s.id — Cisco Umbrella Rank: 126362 |
135 B |
10 | 4 |
Domain | Requested by | |
---|---|---|
4 | mijnlngincasso.eloerp.eu |
mijnlngincasso.eloerp.eu
|
3 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | cdn.jsdelivr.net |
mijnlngincasso.eloerp.eu
|
1 | kit.fontawesome.com |
mijnlngincasso.eloerp.eu
|
1 | s.id | 1 redirects |
10 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
mijnlngincasso.eloerp.eu cPanel, Inc. Certification Authority |
2022-03-29 - 2022-06-27 |
3 months | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-12-01 - 2023-01-01 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-03 - 2022-07-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://mijnlngincasso.eloerp.eu/
Frame ID: 4BC14388FA0681B45D03D848E875BFF8
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
INGPage URL History Show full URLs
-
https://s.id/lngincasseren
HTTP 301
https://mijnlngincasso.eloerp.eu/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://s.id/lngincasseren
HTTP 301
https://mijnlngincasso.eloerp.eu/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
mijnlngincasso.eloerp.eu/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b690895109.js
kit.fontawesome.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ |
152 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
mijnlngincasso.eloerp.eu/assets/css/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.png
mijnlngincasso.eloerp.eu/assets/images/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
mijnlngincasso.eloerp.eu/assets/images/ |
11 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/ |
77 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
3 KB 1 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored object| FontAwesomeKitConfig number| uidEvent object| bootstrap1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mijnlngincasso.eloerp.eu/ | Name: PHPSESSID Value: ar35qka83gidvhml2rgl26r5g1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
ka-f.fontawesome.com
kit.fontawesome.com
mijnlngincasso.eloerp.eu
s.id
2606:4700::6810:5714
2606:4700::6812:1634
2a06:98c1:3121::7
45.126.58.78
95.141.37.100
0a2d5b4783f4d66964a69b95a89203637b50e7696cc56a9dbddb6323495dd11a
34e422e791145890a25d94da60797d633b91f828d6c8a67bb7bb6cef98f0b26a
34f66f46d0aa7094429fa12dfaab0eefe1b384bb110d1696f5f5e08c26d8b264
5e92ed58eba8485f44dd3143b7fbde2c89e0944d0cf587d8fc6f95a26641929e
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
b3e1f8dee8e59647096d9510a08528841d444243a3b616aa8da28627c38777cb
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda