urlscan.io logo urlscan.io
SecurityTrails logo

ing.betaal-verzoek.com Open in urlscan Pro
62.4.16.106  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ing.betaal-verzoek.com/required/templates/ing-inloggen-template.php
Submission: On June 15 via manual from NL — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 62.4.16.106, located in France and belongs to Online SAS, FR. The main domain is ing.betaal-verzoek.com.
TLS certificate: Issued by R3 on June 7th 2022. Valid for: 3 months.
This is the only time ing.betaal-verzoek.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
1 62.4.16.106 12876 (Online SAS)
5 145.221.182.225 15625 (ING-AS Am...)
1 149.210.187.7 20857 (TRANSIP-A...)
7 3
Apex Domain
Subdomains		 Transfer
5 ing.nl
ideal.ing.nl — Cisco Umbrella Rank: 174187
211 KB
1 strategischlui.nl
strategischlui.nl
863 B
1 betaal-verzoek.com
ing.betaal-verzoek.com
3 KB
7 3
Domain Requested by
5 ideal.ing.nl ing.betaal-verzoek.com
ideal.ing.nl
1 strategischlui.nl ing.betaal-verzoek.com
1 ing.betaal-verzoek.com
7 3

This site contains links to these domains. Also see Links.

Domain
ideal.ing.nl
mijn.ing.nl
www.ing.nl
Subject Issuer Validity Valid
ing.betaal-verzoek.com
R3		 2022-06-07 -
2022-09-05		 3 months crt.sh
ideal.ing.nl
Entrust Certification Authority - L1M		 2020-08-17 -
2022-09-29		 2 years crt.sh
strategischlui.nl
R3		 2022-05-17 -
2022-08-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ing.betaal-verzoek.com/required/templates/ing-inloggen-template.php
Frame ID: FC62485AA174A91E33B24DB766F05B1F
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

iDEAL - Mijn ING

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

215 kB
Transfer

716 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ing-inloggen-template.php
ing.betaal-verzoek.com/required/templates/ 		13 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ing.betaal-verzoek.com/required/templates/ing-inloggen-template.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
62.4.16.106 , France, ASN12876 (Online SAS, FR),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
344864451468c1f660d63aba790bd3e518b35e47eabe2b9cfea53ec73cb29096

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
2743
Content-Type
text/html; charset=UTF-8
Date
Wed, 15 Jun 2022 14:23:45 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.29 (Ubuntu)
Vary
Accept-Encoding
the-guide-styles-responsive.min.css
ideal.ing.nl/ideal/static/inloggen/the-guide/css/ 		565 KB
66 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Requested by
Host: ing.betaal-verzoek.com
URL: https://ing.betaal-verzoek.com/required/templates/ing-inloggen-template.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
df789e8fe20b63d56d8b1933b5da0e15b25e43d77eecf1c5a948c4110b8a2279
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://ing.betaal-verzoek.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 14:23:45 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/css
Cache-Control
no-cache
Transfer-Encoding
chunked
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security
max-age=31622400; includeSubDomains
X-ING-Response-ID
e7d95c11-6d77-4305-87b8-9bf1520a55f8
X-XSS-Protection
1; mode=block
logo-ideal.svg
ideal.ing.nl/ideal/static/betalen/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ideal.ing.nl/ideal/static/betalen/img/logo-ideal.svg
Requested by
Host: ing.betaal-verzoek.com
URL: https://ing.betaal-verzoek.com/required/templates/ing-inloggen-template.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
275c90bc01e696fd3cb715cf85aa305867ee8f615719359fc690a2041f120112
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://ing.betaal-verzoek.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 14:23:45 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
image/svg+xml
Cache-Control
no-cache
Transfer-Encoding
chunked
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security
max-age=31622400; includeSubDomains
X-ING-Response-ID
782cb427-e423-41ad-9cc8-fd33d0f6c714
X-XSS-Protection
1; mode=block
qrcode.png
strategischlui.nl/wp-content/uploads/ 		633 B
863 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://strategischlui.nl/wp-content/uploads/qrcode.png
Requested by
Host: ing.betaal-verzoek.com
URL: https://ing.betaal-verzoek.com/required/templates/ing-inloggen-template.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
149.210.187.7 Almere Stad, Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
149-210-187-7.colo.transip.net
Software
nginx/1.14.0 /
Resource Hash
a0e591c4a22f3e57adea45c8da07a42fe22814f9669cfa710cc5c55c7d4e8fe1

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://ing.betaal-verzoek.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 14:23:45 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 26 Jan 2018 14:16:20 GMT
server
nginx/1.14.0
etag
"5a6b3834-279"
content-type
image/png
cache-control
no-cache
content-length
633
accept-ranges
bytes
alternate-protocol
443:quic
expires
Fri, 09 Feb 2018 14:16:20 GMT
INGMeWeb-Bold.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		37 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Bold.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
e5cb35bd410aba4b717a1cc46814a88b50ff311f9514630dffa3480cb43b92e0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://ing.betaal-verzoek.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 14:23:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
3d893d76-c2e6-4591-a13f-4b80eac6c2e6
Vary
Origin
Content-Length
38292
X-XSS-Protection
1; mode=block
INGMeWeb-Regular.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		36 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Regular.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
4a0a7668aaa847d33f49023d0982c6331bc9705cad2586eccb8086a680ef534c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://ing.betaal-verzoek.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 14:23:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
8b0ac0a9-54c9-480f-9b9f-a6655a57c4d0
Vary
Origin
Content-Length
37344
X-XSS-Protection
1; mode=block
ing-icons-v4-5.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		62 KB
64 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ing-icons-v4-5.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
48d8fe3abbdf6620a0203bdb4da7f57621b8f478cdbd054230638233cede2aae
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://ing.betaal-verzoek.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 14:23:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
f8738340-02ac-4e69-a081-46b768b56828
Vary
Origin
Content-Length
63620
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation

1 Cookies

Domain/Path Name / Value
.ideal.ing.nl/ Name: T-SESSION-ID
Value: OhW9aASxS46YotuWelLgIhlfO2KbHYkLoO5hXWxXy9nnpQEiMKCujoyAa3jLJF13