urlscan.io logo urlscan.io
SecurityTrails logo

bwijnen.nl Open in urlscan Pro
2a01:7c8:eb:0:149:210:209:102  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://is.gd/x3iLiK
Effective URL: https://bwijnen.nl/aanmelden/inloggen
Submission: On March 15 via manual from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 2a01:7c8:eb:0:149:210:209:102, located in Netherlands and belongs to TRANSIP-AS Amsterdam, the Netherlands, NL. The main domain is bwijnen.nl.
TLS certificate: Issued by R3 on March 14th 2022. Valid for: 3 months.
This is the only time bwijnen.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a01:7c8:eb:0... 20857 (TRANSIP-A...)
1 2a01:7c8:eb:0... 20857 (TRANSIP-A...)
4 145.221.214.225 15625 (ING-AS Am...)
6 3
Apex Domain
Subdomains		 Transfer
4 ing.nl
ideal.ing.nl — Cisco Umbrella Rank: 207968
209 KB
1 bwijnen.nl
bwijnen.nl
14 KB
1 boskeren.nl
boskeren.nl
340 B
1 is.gd
is.gd — Cisco Umbrella Rank: 72181
478 B
6 4
Domain Requested by
4 ideal.ing.nl bwijnen.nl
ideal.ing.nl
1 bwijnen.nl
1 boskeren.nl
1 is.gd 1 redirects
6 4

This site contains no links.

Subject Issuer Validity Valid
*.boskeren.nl
R3		 2022-03-14 -
2022-06-12		 3 months crt.sh
*.bwijnen.nl
R3		 2022-03-14 -
2022-06-12		 3 months crt.sh
ideal.ing.nl
Entrust Certification Authority - L1M		 2020-08-17 -
2022-09-29		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://bwijnen.nl/aanmelden/inloggen
Frame ID: ED8A5F7DFEBEE3B4E3B3828C479C6788
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Mobiel Bankieren verlengen

Page URL History Show full URLs

  1. https://is.gd/x3iLiK HTTP 301
    https://boskeren.nl/help/ Page URL
  2. https://bwijnen.nl/aanmelden/inloggen Page URL

Page Statistics

6
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

223 kB
Transfer

714 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://is.gd/x3iLiK HTTP 301
    https://boskeren.nl/help/ Page URL
  2. https://bwijnen.nl/aanmelden/inloggen Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://is.gd/x3iLiK HTTP 301
  • https://boskeren.nl/help/

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
boskeren.nl/help/
Redirect Chain
  • https://is.gd/x3iLiK
  • https://boskeren.nl/help/
131 B
340 B 		Document
General
Check archive.org
Download Go to
Full URL
https://boskeren.nl/help/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:7c8:eb:0:149:210:209:118 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9

Response headers

Date
Tue, 15 Mar 2022 08:22:52 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
X-TransIP-Backend
web773
X-TransIP-Balancer
balancer7

Redirect headers

date
Tue, 15 Mar 2022 08:22:52 GMT
content-type
text/html; charset=UTF-8
location
https://boskeren.nl/help/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WYPIbWlpWQW%2BdHw1gBawOWdVlob9TLvtpoku4PgIY2R6kMOTeuNeGebRriPWEVpkLb2wFlYuzIMVOpTkJ90TPRvzw%2F%2FDIW8cqNr8UcA1SZY%2FWCRBqUS0lJPaI5t8BO2aF0K8"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6ec3d803dc079004-FRA
Primary Request inloggen
bwijnen.nl/aanmelden/ 		13 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bwijnen.nl/aanmelden/inloggen
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:7c8:eb:0:149:210:209:102 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software
Apache /
Resource Hash
fc9fde4a712c31bb626a5e861d5a895692ead750faf84cd34ce696c3ce7bed27

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9
Referer
https://boskeren.nl/

Response headers

Date
Tue, 15 Mar 2022 08:22:53 GMT
Server
Apache
Content-Location
inloggen.php
Vary
negotiate
TCN
choice
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
X-TransIP-Backend
web692
X-TransIP-Balancer
balancer6
the-guide-styles-responsive.min.css
ideal.ing.nl/ideal/static/inloggen/the-guide/css/ 		565 KB
66 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Requested by
Host: bwijnen.nl
URL: https://bwijnen.nl/aanmelden/inloggen
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.214.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
df789e8fe20b63d56d8b1933b5da0e15b25e43d77eecf1c5a948c4110b8a2279
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://bwijnen.nl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 08:22:53 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/css
Cache-Control
no-cache
Transfer-Encoding
chunked
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security
max-age=31622400; includeSubDomains
X-ING-Response-ID
fba5c63c-f07d-41cc-89d5-bef32fbbc8a3
X-XSS-Protection
1; mode=block
INGMeWeb-Regular.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		36 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Regular.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.214.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
4a0a7668aaa847d33f49023d0982c6331bc9705cad2586eccb8086a680ef534c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://bwijnen.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 08:22:53 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
9a3712fd-4853-4a5e-bc41-17b4f510a415
Vary
Origin
Content-Length
37344
X-XSS-Protection
1; mode=block
ing-icons-v4-5.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		62 KB
64 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ing-icons-v4-5.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.214.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
48d8fe3abbdf6620a0203bdb4da7f57621b8f478cdbd054230638233cede2aae
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://bwijnen.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 08:22:53 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
c8e17e73-def0-4639-b4bf-83049ba86e2b
Vary
Origin
Content-Length
63620
X-XSS-Protection
1; mode=block
INGMeWeb-Bold.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		37 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Bold.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.214.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
e5cb35bd410aba4b717a1cc46814a88b50ff311f9514630dffa3480cb43b92e0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://bwijnen.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Tue, 15 Mar 2022 08:22:53 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
020ce51e-0bff-481a-84c5-e0e48c4a95a2
Vary
Origin
Content-Length
38292
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

2 Cookies

Domain/Path Name / Value
.ideal.ing.nl/ Name: T-SESSION-ID
Value: qHID9b9nbRKmtRW-T5HfIushx7Lclmgc2sFvPNC8IYuwDplqs6zXcCYoMiPkAthb
.ing.nl/ Name: C-SESSION-ID
Value: 26767PW7HqLcf93DYbep5j7PDTnrWq88SHqfJ368x1SFgaZI4BkcEU500D23BA9B000DDD42589ADF29A