urlscan.io logo urlscan.io
SecurityTrails logo

hofengel.nl Open in urlscan Pro
2a01:7c8:eb:0:149:210:170:54  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://boskeren.nl/help/
Effective URL: https://hofengel.nl/updaten/inloggen
Submission: On March 15 via manual from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2a01:7c8:eb:0:149:210:170:54, located in Netherlands and belongs to TRANSIP-AS Amsterdam, the Netherlands, NL. The main domain is hofengel.nl.
TLS certificate: Issued by R3 on March 14th 2022. Valid for: 3 months.
This is the only time hofengel.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2a01:7c8:eb:0... 20857 (TRANSIP-A...)
1 2a01:7c8:eb:0... 20857 (TRANSIP-A...)
4 145.221.182.225 15625 (ING-AS Am...)
6 3
Apex Domain
Subdomains		 Transfer
4 ing.nl
ideal.ing.nl — Cisco Umbrella Rank: 207968
209 KB
1 hofengel.nl
hofengel.nl
14 KB
1 boskeren.nl
boskeren.nl
339 B
6 3
Domain Requested by
4 ideal.ing.nl hofengel.nl
ideal.ing.nl
1 hofengel.nl
1 boskeren.nl
6 3

This site contains no links.

Subject Issuer Validity Valid
*.boskeren.nl
R3		 2022-03-14 -
2022-06-12		 3 months crt.sh
*.hofengel.nl
R3		 2022-03-14 -
2022-06-12		 3 months crt.sh
ideal.ing.nl
Entrust Certification Authority - L1M		 2020-08-17 -
2022-09-29		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://hofengel.nl/updaten/inloggen
Frame ID: 7AF0DC293CA220946A4437904792E5FB
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Mobiel Bankieren verlengen

Page URL History Show full URLs

  1. https://boskeren.nl/help/ Page URL
  2. https://hofengel.nl/updaten/inloggen Page URL

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

223 kB
Transfer

714 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://boskeren.nl/help/ Page URL
  2. https://hofengel.nl/updaten/inloggen Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
boskeren.nl/help/ 		130 B
339 B 		Document
General
Check archive.org
Download Go to
Full URL
https://boskeren.nl/help/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:7c8:eb:0:149:210:209:118 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software
Apache /
Resource Hash
1ed2988b19c9c28cb9924abc2805766b0b566516181fad0fbd5a9739cd7f7cc5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9

Response headers

Date
Tue, 15 Mar 2022 15:11:51 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
X-TransIP-Backend
web773
X-TransIP-Balancer
balancer0
Primary Request inloggen
hofengel.nl/updaten/ 		13 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hofengel.nl/updaten/inloggen
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:7c8:eb:0:149:210:170:54 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software
Apache /
Resource Hash
fc9fde4a712c31bb626a5e861d5a895692ead750faf84cd34ce696c3ce7bed27

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9
Referer
https://boskeren.nl/

Response headers

Date
Tue, 15 Mar 2022 15:11:51 GMT
Server
Apache
Content-Location
inloggen.php
Vary
negotiate
TCN
choice
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
X-TransIP-Backend
web764
X-TransIP-Balancer
balancer6
the-guide-styles-responsive.min.css
ideal.ing.nl/ideal/static/inloggen/the-guide/css/ 		565 KB
66 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Requested by
Host: hofengel.nl
URL: https://hofengel.nl/updaten/inloggen
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
df789e8fe20b63d56d8b1933b5da0e15b25e43d77eecf1c5a948c4110b8a2279
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://hofengel.nl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 15:11:51 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/css
Cache-Control
no-cache
Transfer-Encoding
chunked
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security
max-age=31622400; includeSubDomains
X-ING-Response-ID
3f394ca8-ec79-4b22-844f-4493122cf502
X-XSS-Protection
1; mode=block
INGMeWeb-Regular.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		36 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Regular.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
4a0a7668aaa847d33f49023d0982c6331bc9705cad2586eccb8086a680ef534c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://hofengel.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 15:11:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
ffcdb933-88a2-4d00-be91-043e7b71b997
Vary
Origin
Content-Length
37344
X-XSS-Protection
1; mode=block
ing-icons-v4-5.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		62 KB
64 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ing-icons-v4-5.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
48d8fe3abbdf6620a0203bdb4da7f57621b8f478cdbd054230638233cede2aae
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://hofengel.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 15:11:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
7fef6457-e3b5-4131-b9fd-b3be065b34e3
Vary
Origin
Content-Length
63620
X-XSS-Protection
1; mode=block
INGMeWeb-Bold.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		37 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Bold.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
e5cb35bd410aba4b717a1cc46814a88b50ff311f9514630dffa3480cb43b92e0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://hofengel.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 15:11:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
8e790a62-e025-4787-9e4b-be21af6b0502
Vary
Origin
Content-Length
38292
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

1 Cookies

Domain/Path Name / Value
.ideal.ing.nl/ Name: T-SESSION-ID
Value: 4Al0B8ShVzmrWz-imT1AItSXT4NcJ3jwnlF0QnyIyWAT8tcBzYrbAAPrgrbWZ7wc