mijn-login.site Open in urlscan Pro
23.254.226.229 Malicious Activity! Public Scan

URL:
http://mijn-login.site/
Submission: On June 07 via manual (June 7th 2020, 11:15:58 am UTC) from US

Summary HTTP 3 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 2 domains to perform 3 HTTP transactions. The main IP is 23.254.226.229, located in Seattle, United States and belongs to HOSTWINDS, US. The main domain is mijn-login.site.

This is the only time mijn-login.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	23.254.226.229 23.254.226.229	54290 (HOSTWINDS) (HOSTWINDS)
1 1	2.23.176.212 2.23.176.212	16625 (AKAMAI-AS) (AKAMAI-AS)
1	23.222.62.64 23.222.62.64	16625 (AKAMAI-AS) (AKAMAI-AS)
3	3

1 23.254.226.229 (Seattle, United States)

ASN54290 (HOSTWINDS, US)
PTR: hwsrv-724889.hostwindsdns.com

mijn-login.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.23.176.212 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)

ing.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.222.62.64 (Netherlands)

ASN16625 (AKAMAI-AS, US)

www.ing.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ing.nl 1 redirects ing.nl www.ing.nl	3 KB
1	mijn-login.site mijn-login.site	222 KB
3	2

	Domain	Requested by
1	www.ing.nl	mijn-login.site
1	ing.nl	1 redirects
1	mijn-login.site	mijn-login.site
3	3

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
instagram.com
www.linkedin.com
www.youtube.com

Subject Issuer	Validity	Valid
www.ing.nl Entrust Certification Authority - L1M	`2019-03-29` - `2021-04-30`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://mijn-login.site/
Frame ID: 22A651CF934F6AA040462BA184214835
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

3
Requests

33 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

3
Countries

292 kB
Transfer

1052 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/ingbankbelgie
Title: ING op Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/ingbelgie
Title: ING op Twitter

Search URL Search Domain Scan URL

URL: https://instagram.com/ingbelgium/
Title: ING op Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ingbelgium
Title: ING op LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/ingbelgie
Title: ING op Youtube

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://ing.nl/assets/web/ng/img/gBetaalverzoek-general.svg HTTP 301
https://www.ing.nl/assets/web/ng/img/gBetaalverzoek-general.svg

3 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
mijn-login.site/ 884 KB
222 KB 313ms
110ms Document
text/html 23.254.226.229
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://mijn-login.site/
Protocol: HTTP/1.1
Server: 23.254.226.229 Seattle, United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: hwsrv-724889.hostwindsdns.com
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: d95457bfcc26340ae231d1af6b1afe924e6b59d33c7fb5a67ad7665eb23b96da

Request headers

Host: mijn-login.site
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 07 Jun 2020 11:15:23 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Sat, 06 Jun 2020 14:13:48 GMT
ETag: "dd0f2-5a76afc7d5f00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1

200
OK

gBetaalverzoek-general.svg
www.ing.nl/assets/web/ng/img/
Redirect Chain

https://ing.nl/assets/web/ng/img/gBetaalverzoek-general.svg
https://www.ing.nl/assets/web/ng/img/gBetaalverzoek-general.svg

5 KB
2 KB

200ms
63ms

Image
image/svg+xml

23.222.62.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ing.nl/assets/web/ng/img/gBetaalverzoek-general.svg

Requested by

Host: mijn-login.site
URL: http://mijn-login.site/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.222.62.64 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

5f2363faa5e0a7644c4f0da64e621d4c4fd3f59f85145a0ad7eae5102f745ae4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31622400; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 05 Jun 2020 08:55:52 GMT
Date: Sun, 07 Jun 2020 11:15:24 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
X-Cnection: close
Connection: keep-alive
Accept-Ranges: bytes
X-ING-Response-ID: e1f42d98-0ea7-46c0-83c3-ecaac24ab817
Vary: Accept-Encoding
Content-Length: 1986
X-XSS-Protection: 1; mode=block

Redirect headers

Date: Sun, 07 Jun 2020 11:15:23 GMT
X-Content-Type-Options: nosniff
Server: AkamaiGHost
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31622400; includeSubDomains
Location: https://www.ing.nl/assets/web/ng/img/gBetaalverzoek-general.svg
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65deab28b2f136bbb6333eabede19914ec071a9b091fd3e6961be0e9fc55335c

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e7217f62f10999adfa1af76b160fa038b4dab522af27c423f4d2650f0261fa73

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f44b6e0caef529146b522c164474162f8823084783e82a783768c00892c37e4b

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 668c32e548ecf4c72ffbe0c0894dc7900493720f4669ff309d843f86f2f490d5

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 894654f89d72c5f36792acbe3d0358620dd5f8230e2dacad461e59e5322f39b2

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET /
mijn-login.site/ 0
0

GET
DATA 200
OK truncated
/ 68 KB
68 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b5249aa62da52d9853ebd8a7c8f43ed84b3941f10bd6cd7eff0619889daa2d2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: http://mijn-login.site

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 21 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 46398f6374e7f7afd4384087d40fc17b640714a90fb7267aeb8b4ebb60cc7df1

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7495eb01bf30ea2ecc83a6f3625e1f8eeee080bdd186714547afd180bc367041

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 19 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 457e3fb9bb24d5be5b0f6d618a44bd19c1a1f3a659d86bfca5bb0fbece450c1b

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 25 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d446f32e87fa5d7bd7d2e8517a84020fad6a9441fae26b85079e700e30c13db

Request headers

Referer: http://mijn-login.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mijn-login.site
URL: https://mijn-login.site/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ing.nl
mijn-login.site
www.ing.nl
mijn-login.site
2.23.176.212
23.222.62.64
23.254.226.229
0d446f32e87fa5d7bd7d2e8517a84020fad6a9441fae26b85079e700e30c13db
3b5249aa62da52d9853ebd8a7c8f43ed84b3941f10bd6cd7eff0619889daa2d2
457e3fb9bb24d5be5b0f6d618a44bd19c1a1f3a659d86bfca5bb0fbece450c1b
46398f6374e7f7afd4384087d40fc17b640714a90fb7267aeb8b4ebb60cc7df1
5f2363faa5e0a7644c4f0da64e621d4c4fd3f59f85145a0ad7eae5102f745ae4
65deab28b2f136bbb6333eabede19914ec071a9b091fd3e6961be0e9fc55335c
668c32e548ecf4c72ffbe0c0894dc7900493720f4669ff309d843f86f2f490d5
7495eb01bf30ea2ecc83a6f3625e1f8eeee080bdd186714547afd180bc367041
894654f89d72c5f36792acbe3d0358620dd5f8230e2dacad461e59e5322f39b2
d95457bfcc26340ae231d1af6b1afe924e6b59d33c7fb5a67ad7665eb23b96da
e7217f62f10999adfa1af76b160fa038b4dab522af27c423f4d2650f0261fa73
f44b6e0caef529146b522c164474162f8823084783e82a783768c00892c37e4b

mijn-login.site Open in urlscan Pro 23.254.226.229 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

3 Requests

33 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

3 Countries

292 kBTransfer

1052 kBSize

0 Cookies

5 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

mijn-login.site Open in urlscan Pro
23.254.226.229 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

33 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

3
Countries

292 kB
Transfer

1052 kB
Size

0
Cookies

3 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!