ing-nl-belastingteruggave.switchmail147.delivery Open in urlscan Pro
167.99.2.163 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://invy-onlinef.tumblr.com/
Effective URL:
https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Submission: On March 26 via manual (March 26th 2018, 9:46:03 am UTC) from NL

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 21 HTTP transactions. The main IP is 167.99.2.163, located in Fort Worth, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is ing-nl-belastingteruggave.switchmail147.delivery.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 26th 2018. Valid for: 3 months.

This is the only time ing-nl-belastingteruggave.switchmail147.delivery was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	66.6.33.149 66.6.33.149	26101 (YAHOO-3) (YAHOO-3 - Yahoo!)
4	87.248.118.23 87.248.118.23	203220 (YAHOO-DEB) (YAHOO-DEB)
9	167.99.2.163 167.99.2.163	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
6	145.221.213.241 145.221.213.241	15625 (ING-AS Am...) (ING-AS Amsterdam)
1	145.221.181.241 145.221.181.241	15625 (ING-AS Am...) (ING-AS Amsterdam)
21	5

1 66.6.33.149 (New York, United States)

ASN26101 (YAHOO-3 - Yahoo!, US)

invy-onlinef.tumblr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 87.248.118.23 (United Kingdom)

ASN203220 (YAHOO-DEB, DE)
PTR: e2.ycpi.vip.deb.yahoo.com

assets.tumblr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 167.99.2.163 (Fort Worth, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: vps.ghost147.com

ing-nl-belastingteruggave.switchmail147.delivery	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 145.221.213.241 (Amsterdam, Netherlands)

ASN15625 (ING-AS Amsterdam, NL)

mijn.ing.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 145.221.181.241 (Amstelveen, Netherlands)

ASN15625 (ING-AS Amsterdam, NL)

mijn.ing.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	switchmail147.delivery ing-nl-belastingteruggave.switchmail147.delivery	180 KB
7	ing.nl mijn.ing.nl	16 KB
5	tumblr.com invy-onlinef.tumblr.com assets.tumblr.com	194 KB
21	3

	Domain	Requested by
9	ing-nl-belastingteruggave.switchmail147.delivery	ing-nl-belastingteruggave.switchmail147.delivery
7	mijn.ing.nl	ing-nl-belastingteruggave.switchmail147.delivery
4	assets.tumblr.com	invy-onlinef.tumblr.com
1	invy-onlinef.tumblr.com
21	4

This site contains no links.

Subject Issuer	Validity	Valid
*.tumblr.com DigiCert SHA2 High Assurance Server CA	`2017-10-24` - `2018-04-23`	6 months	crt.sh
secure.assets.tumblr.com DigiCert SHA2 High Assurance Server CA	`2017-12-05` - `2018-06-05`	6 months	crt.sh
ing-nl-belastingteruggave.switchmail147.delivery cPanel, Inc. Certification Authority	`2018-03-26` - `2018-06-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Frame ID: 341B175BDCE339FB69CCA5BE89D7E6DD
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://invy-onlinef.tumblr.com/ Page URL
https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/ Page URL

Detected technologies

Tumblr (Blogs) Expand

Overall confidence: 100%
Detected patterns

url /^https?:\/\/(?:www\.)?[^\/]+\.tumblr\.com\//i

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

21
Requests

67 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

390 kB
Transfer

857 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://invy-onlinef.tumblr.com/ Page URL
https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
invy-onlinef.tumblr.com/ 13 KB
5 KB 306ms
100ms Document
text/html 66.6.33.149
Yahoo!

General

Check archive.org

Show headers Download Go to

Full URL

https://invy-onlinef.tumblr.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

66.6.33.149 New York, United States, ASN26101 (YAHOO-3 - Yahoo!, US),

Reverse DNS

Software

openresty /

Resource Hash

9a5d215ed6ea6d5c5064bd1582d820e08298afd60dd01d9e4ac5010453105868

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552001
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: invy-onlinef.tumblr.com
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 26 Mar 2018 09:45:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-tumblr-user: invy-onlinef
p3p: CP="Tumblr's privacy policy is available here: https://www.tumblr.com/policy/en/privacy"
status: 200
x-rid: ee602f4cd15a79131bdf3528d520ebee
x-ua-device: desktop
x-tumblr-pixel: 1
vary: Accept-Encoding X-UA-Device, Accept, Accept-Encoding
content-length: 4663
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge,chrome=1
server: openresty
strict-transport-security: max-age=15552001
content-type: text/html; charset=UTF-8
x-tumblr-pixel-0: https://px.srvcs.tumblr.com/impixu?T=1522057535&J=eyJ0eXBlIjoidXJsIiwidXJsIjoiaHR0cDpcL1wvaW52eS1vbmxpbmVmLnR1bWJsci5jb21cLyIsInJlcXR5cGUiOjAsInJvdXRlIjoiXC8ifQ==&U=KAEGKMAFIH&K=c573ea500233bfb491a5a478bef691ecc0fecbb7bcbf6e3fbba9367304a95399
accept-ranges: bytes
link: <https://assets.tumblr.com/images/default_avatar/pyramid_closed_128.png>; rel=icon

GET
H2 200 stylesheet.css
assets.tumblr.com/fonts/gibson/ 2 KB
2 KB 33ms
12ms Stylesheet
text/css 87.248.118.23
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.tumblr.com/fonts/gibson/stylesheet.css?v=3

Requested by

Host: invy-onlinef.tumblr.com
URL: https://invy-onlinef.tumblr.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

87.248.118.23 , United Kingdom, ASN203220 (YAHOO-DEB, DE),

Reverse DNS

e2.ycpi.vip.deb.yahoo.com

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /fonts/gibson/stylesheet.css?v=3
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: assets.tumblr.com
referer: https://invy-onlinef.tumblr.com/
:scheme: https
:method: GET
Referer: https://invy-onlinef.tumblr.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Fri, 09 Mar 2018 09:43:32 GMT
content-encoding: gzip
vary: Accept-Encoding Accept-Encoding
age: 1468928
status: 200
content-length: 655
access-control-allow-origin: *
last-modified: Sun, 11 Feb 2018 08:11:11 GMT
server: ATS
etag: W/"5a7ffa9f-97e"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: text/css
via: http/1.1 sc19.ycpi.bf1.yahoo.com (ApacheTrafficServer [cHs f ]), http/1.1 e3.ycpi.deb.yahoo.com (ApacheTrafficServer [cRs f ])
cache-control: max-age=315360000 immutable
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 pre_tumblelog.js
assets.tumblr.com/assets/scripts/ 3 KB
2 KB 34ms
13ms Script
application/javascript 87.248.118.23
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.tumblr.com/assets/scripts/pre_tumblelog.js?_v=472beb185dc3d62d59bcf893499ebf45

Requested by

Host: invy-onlinef.tumblr.com
URL: https://invy-onlinef.tumblr.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

87.248.118.23 , United Kingdom, ASN203220 (YAHOO-DEB, DE),

Reverse DNS

e2.ycpi.vip.deb.yahoo.com

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /assets/scripts/pre_tumblelog.js?_v=472beb185dc3d62d59bcf893499ebf45
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: assets.tumblr.com
referer: https://invy-onlinef.tumblr.com/
:scheme: https
:method: GET
Referer: https://invy-onlinef.tumblr.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Sun, 25 Mar 2018 17:14:21 GMT
content-encoding: gzip
vary: Accept-Encoding Accept-Encoding
age: 59479
status: 200
content-length: 1370
access-control-allow-origin: *
last-modified: Sun, 11 Mar 2018 06:45:19 GMT
server: ATS
etag: W/"5aa4d07f-c3e"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: application/javascript; charset=utf-8
via: https/1.1 sc14.ycpi.bf1.yahoo.com (ApacheTrafficServer [cMsSfW]), http/1.1 e3.ycpi.deb.yahoo.com (ApacheTrafficServer [cRs f ])
cache-control: max-age=315360000 immutable
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 index.build.js
assets.tumblr.com/client/prod/standalone/tumblelog/ 652 KB
185 KB 34ms
13ms Script
application/javascript 87.248.118.23
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.tumblr.com/client/prod/standalone/tumblelog/index.build.js?_v=bade0c32f65b3bfdd8ef21a8fc7b9966

Requested by

Host: invy-onlinef.tumblr.com
URL: https://invy-onlinef.tumblr.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

87.248.118.23 , United Kingdom, ASN203220 (YAHOO-DEB, DE),

Reverse DNS

e2.ycpi.vip.deb.yahoo.com

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /client/prod/standalone/tumblelog/index.build.js?_v=bade0c32f65b3bfdd8ef21a8fc7b9966
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: assets.tumblr.com
referer: https://invy-onlinef.tumblr.com/
:scheme: https
:method: GET
Referer: https://invy-onlinef.tumblr.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Sat, 24 Mar 2018 13:01:01 GMT
content-encoding: gzip
vary: Accept-Encoding Accept-Encoding
age: 161079
status: 200
content-length: 189384
access-control-allow-origin: *
last-modified: Tue, 13 Mar 2018 19:46:38 GMT
server: ATS
etag: W/"5aa82a9e-a2f3f"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: application/javascript; charset=utf-8
via: https/1.1 sc6.ycpi.bf1.yahoo.com (ApacheTrafficServer [cMsSfW]), http/1.1 e3.ycpi.deb.yahoo.com (ApacheTrafficServer [cRs f ])
cache-control: max-age=315360000 immutable
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tumblelog_post_message_queue.js
assets.tumblr.com/assets/scripts/ 355 B
434 B 33ms
13ms Script
application/javascript 87.248.118.23
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.tumblr.com/assets/scripts/tumblelog_post_message_queue.js?_v=8a635a4514a95df9615127e354b374d0

Requested by

Host: invy-onlinef.tumblr.com
URL: https://invy-onlinef.tumblr.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

87.248.118.23 , United Kingdom, ASN203220 (YAHOO-DEB, DE),

Reverse DNS

e2.ycpi.vip.deb.yahoo.com

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /assets/scripts/tumblelog_post_message_queue.js?_v=8a635a4514a95df9615127e354b374d0
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: assets.tumblr.com
referer: https://invy-onlinef.tumblr.com/
:scheme: https
:method: GET
Referer: https://invy-onlinef.tumblr.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 26 Mar 2018 07:48:45 GMT
content-encoding: gzip
vary: Accept-Encoding Accept-Encoding
age: 7017
status: 200
content-length: 204
access-control-allow-origin: *
last-modified: Sun, 11 Mar 2018 06:45:19 GMT
server: ATS
etag: W/"5aa4d07f-163"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: application/javascript; charset=utf-8
via: https/1.1 sc11.ycpi.dcc.yahoo.com (ApacheTrafficServer [cMsSfW]), http/1.1 e3.ycpi.deb.yahoo.com (ApacheTrafficServer [cRs f ])
cache-control: max-age=315360000 immutable
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK Primary Request / Show response
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/ 15 KB
15 KB 11562ms
334ms Document
text/html 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: 8eafdf48f93642a91806dd758fb87468c2675001e001b2c0ffa0996a0acd7ac0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://invy-onlinef.tumblr.com/
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: https://invy-onlinef.tumblr.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ses_style_v7.css
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 39 KB
39 KB 208ms
110ms Stylesheet
text/css 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: f995a7d176e30508bbef813040e2399748ad9d21ae3c2ceb221c6e489996a7cf

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sat, 24 Mar 2018 12:34:10 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 39981

GET
H/1.1 200
OK jquery-1.js Show response
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 92 KB
92 KB 210ms
106ms Script
application/javascript 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: 88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: */*
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sat, 24 Mar 2018 12:23:42 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 93868

GET
H/1.1 200
OK ses_functions_v5.js Show response
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 4 KB
4 KB 264ms
89ms Script
application/javascript 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_functions_v5.js
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: b11657f93cbc0509abf6645dcb945d40054ff871068f1f38f6087a244419db96

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: */*
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sun, 25 Mar 2018 10:00:58 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3997

GET
H/1.1 200
OK ses_loginvalidation.js Show response
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 1 KB
1 KB 265ms
90ms Script
application/javascript 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_loginvalidation.js
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: 4d670f5674dd4724bfa8341fcbea9924303f38183e14107c84821389f9413a23

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: */*
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sun, 25 Mar 2018 09:52:42 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1110

GET
H/1.1 200
OK SES_logo_ing.gif
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 1 KB
2 KB 111ms
110ms Image
image/gif 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/SES_logo_ing.gif
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: ef1609ab93ab54ad732e0d7a8340e6bf8f8426a11354718e50e1033bce6abcae

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sat, 24 Mar 2018 12:23:42 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1342

GET
H/1.1 200
OK pixel.gif
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 42 B
282 B 111ms
111ms Image
image/gif 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/pixel.gif
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sat, 24 Mar 2018 12:23:42 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 42

GET
H/1.1 200
OK inlog_rechts_particulier.png
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 20 KB
20 KB 107ms
106ms Image
image/png 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/inlog_rechts_particulier.png
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: 89f89d807799b283f60830ac259b5a95c8572ffb58d41b215f8f22fd83b68487

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sat, 24 Mar 2018 14:54:42 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 20660

GET
H/1.1 200
OK veilig_bankieren.jpg
ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ 5 KB
6 KB 92ms
91ms Image
image/jpeg 167.99.2.163
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/veilig_bankieren.jpg
Requested by: Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.99.2.163 Fort Worth, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS: vps.ghost147.com
Software: Apache /
Resource Hash: 1c4be72b6b074c6ce315b2d38e0a06caae92fb9b98cab20d65df3a33cbabb9ea

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ing-nl-belastingteruggave.switchmail147.delivery
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
Last-Modified: Sat, 24 Mar 2018 14:54:42 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 5470

GET
H/1.1 200
OK SOL_1px_transparent.gif
mijn.ing.nl/internetbankieren/css/images/ 42 B
1018 B 186ms
24ms Image
image/gif 145.221.213.241
ING-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mijn.ing.nl/internetbankieren/css/images/SOL_1px_transparent.gif

Requested by

Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js

Protocol

HTTP/1.1

Server

145.221.213.241 Amsterdam, Netherlands, ASN15625 (ING-AS Amsterdam, NL),

Reverse DNS

Software

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Feb 2018 12:48:08 GMT
Strict-Transport-Security: max-age=31622400
Content-Language: en-US
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK SOL_workbench1280_sprite.png
mijn.ing.nl/internetbankieren/css/images/ 2 KB
3 KB 185ms
24ms Image
image/png 145.221.213.241
ING-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mijn.ing.nl/internetbankieren/css/images/SOL_workbench1280_sprite.png

Requested by

Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js

Protocol

HTTP/1.1

Server

145.221.213.241 Amsterdam, Netherlands, ASN15625 (ING-AS Amsterdam, NL),

Reverse DNS

Software

Resource Hash

f6d268f294dd885163c48b153736f2d33dcbacf132adf5a9abee92ddb34e5d94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Feb 2018 12:48:08 GMT
Strict-Transport-Security: max-age=31622400
Content-Language: en-US
Connection: keep-alive
Content-Type: image/png
Content-Length: 1892
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK SES_icon_sprite_v2.png
mijn.ing.nl/internetbankieren/css/images/ 2 KB
3 KB 186ms
24ms Image
image/png 145.221.213.241
ING-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mijn.ing.nl/internetbankieren/css/images/SES_icon_sprite_v2.png

Requested by

Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js

Protocol

HTTP/1.1

Server

145.221.213.241 Amsterdam, Netherlands, ASN15625 (ING-AS Amsterdam, NL),

Reverse DNS

Software

Resource Hash

f9408ea23972ed3724cc814de48d44369750c6022f204c711f9cdd4263d26856

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Feb 2018 12:48:08 GMT
Strict-Transport-Security: max-age=31622400
Content-Language: en-US
Connection: keep-alive
Content-Type: image/png
Content-Length: 2413
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK SES_slot.jpg
mijn.ing.nl/internetbankieren/css/images/ 3 KB
3 KB 191ms
26ms Image
image/jpeg 145.221.213.241
ING-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mijn.ing.nl/internetbankieren/css/images/SES_slot.jpg

Requested by

Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js

Protocol

HTTP/1.1

Server

145.221.213.241 Amsterdam, Netherlands, ASN15625 (ING-AS Amsterdam, NL),

Reverse DNS

Software

Resource Hash

16d954e2f3eb65a5c73b0774e6a4071bb29905e35e07b9b4b48bfe85029807b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Feb 2018 12:48:08 GMT
Strict-Transport-Security: max-age=31622400
Content-Language: en-US
Connection: keep-alive
Content-Type: image/jpeg
Content-Length: 2583
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK SES_icon_sprite_notifications.png
mijn.ing.nl/internetbankieren/css/images/ 1 KB
2 KB 191ms
27ms Image
image/png 145.221.181.241
ING-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mijn.ing.nl/internetbankieren/css/images/SES_icon_sprite_notifications.png

Requested by

Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js

Protocol

HTTP/1.1

Server

145.221.181.241 Amstelveen, Netherlands, ASN15625 (ING-AS Amsterdam, NL),

Reverse DNS

Software

Resource Hash

27a1f073f774f038941b52de623f76049c404ce0e244060bab648104c124b700

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Feb 2018 12:48:08 GMT
Strict-Transport-Security: max-age=31622400
Content-Language: en-US
Connection: keep-alive
Content-Type: image/png
Content-Length: 1079
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK SOL_gradients_sprite.png
mijn.ing.nl/internetbankieren/css/images/ 200 B
1 KB 208ms
24ms Image
image/png 145.221.213.241
ING-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mijn.ing.nl/internetbankieren/css/images/SOL_gradients_sprite.png

Requested by

Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js

Protocol

HTTP/1.1

Server

145.221.213.241 Amsterdam, Netherlands, ASN15625 (ING-AS Amsterdam, NL),

Reverse DNS

Software

Resource Hash

6bde7d708981a95ba39db6872eb9aec7a118dd0027c79b59b5dee5dde51d9f10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Feb 2018 12:48:08 GMT
Strict-Transport-Security: max-age=31622400
Content-Language: en-US
X-Cnection: close
Connection: keep-alive
Content-Type: image/png
Content-Length: 200
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK SOL_tabs_sprite_v2.png
mijn.ing.nl/internetbankieren/css/images/ 1 KB
2 KB 145ms
25ms Image
image/png 145.221.213.241
ING-AS Amsterdam

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mijn.ing.nl/internetbankieren/css/images/SOL_tabs_sprite_v2.png

Requested by

Host: ing-nl-belastingteruggave.switchmail147.delivery
URL: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/jquery-1.js

Protocol

HTTP/1.1

Server

145.221.213.241 Amsterdam, Netherlands, ASN15625 (ING-AS Amsterdam, NL),

Reverse DNS

Software

Resource Hash

87329058dda77832b04cfb2c30a8bfc4b3ea9a1a8a7b068e0e68ed99cb31971a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ing-nl-belastingteruggave.switchmail147.delivery/internetbankieren/SesamLoginServlet/filles/ses_style_v7.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 26 Mar 2018 09:45:52 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Feb 2018 12:48:08 GMT
Strict-Transport-Security: max-age=31622400
Content-Language: en-US
Connection: keep-alive
Content-Type: image/png
Content-Length: 1281
X-XSS-Protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552001
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.tumblr.com
ing-nl-belastingteruggave.switchmail147.delivery
invy-onlinef.tumblr.com
mijn.ing.nl
145.221.181.241
145.221.213.241
167.99.2.163
66.6.33.149
87.248.118.23
16d954e2f3eb65a5c73b0774e6a4071bb29905e35e07b9b4b48bfe85029807b2
1c4be72b6b074c6ce315b2d38e0a06caae92fb9b98cab20d65df3a33cbabb9ea
27a1f073f774f038941b52de623f76049c404ce0e244060bab648104c124b700
4d670f5674dd4724bfa8341fcbea9924303f38183e14107c84821389f9413a23
6bde7d708981a95ba39db6872eb9aec7a118dd0027c79b59b5dee5dde51d9f10
87329058dda77832b04cfb2c30a8bfc4b3ea9a1a8a7b068e0e68ed99cb31971a
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
89f89d807799b283f60830ac259b5a95c8572ffb58d41b215f8f22fd83b68487
8eafdf48f93642a91806dd758fb87468c2675001e001b2c0ffa0996a0acd7ac0
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a5d215ed6ea6d5c5064bd1582d820e08298afd60dd01d9e4ac5010453105868
b11657f93cbc0509abf6645dcb945d40054ff871068f1f38f6087a244419db96
ef1609ab93ab54ad732e0d7a8340e6bf8f8426a11354718e50e1033bce6abcae
f6d268f294dd885163c48b153736f2d33dcbacf132adf5a9abee92ddb34e5d94
f9408ea23972ed3724cc814de48d44369750c6022f204c711f9cdd4263d26856
f995a7d176e30508bbef813040e2399748ad9d21ae3c2ceb221c6e489996a7cf

ing-nl-belastingteruggave.switchmail147.delivery Open in urlscan Pro 167.99.2.163 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

67 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

3 Countries

390 kBTransfer

857 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

ing-nl-belastingteruggave.switchmail147.delivery Open in urlscan Pro
167.99.2.163 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

67 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

390 kB
Transfer

857 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!