www.servicenets.nl
Open in
urlscan Pro
81.169.145.72
Malicious Activity!
Public Scan
URL:
http://www.servicenets.nl/vc/methode.html
Submission: On April 07 via automatic, source openphish
Submission: On April 07 via automatic, source openphish
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 81.169.145.72, located in
Berlin, Germany and
belongs to STRATO STRATO AG, DE.
The main domain is www.servicenets.nl.
This is the only time www.servicenets.nl was scanned on urlscan.io!
This is the only time www.servicenets.nl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 81.169.145.72 81.169.145.72 | 6724 (STRATO ST...) (STRATO STRATO AG) | |
| 12 | 145.221.182.225 145.221.182.225 | 26415 (VERISIGN-INC) (VERISIGN-INC - VeriSign Global Registry Services) | |
| 14 | 3 |
1
81.169.145.72
(Berlin, Germany)
ASN6724 (STRATO STRATO AG, DE)
PTR: w08.rzone.de
ASN6724 (STRATO STRATO AG, DE)
PTR: w08.rzone.de
| www.servicenets.nl |
12
145.221.182.225
(Amstelveen, Netherlands)
ASN26415 (VERISIGN-INC - VeriSign Global Registry Services, US)
ASN26415 (VERISIGN-INC - VeriSign Global Registry Services, US)
| ideal.ing.nl |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
ing.nl
ideal.ing.nl mon.retail.ing.nl Failed |
159 KB |
| 1 |
servicenets.nl
www.servicenets.nl |
7 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 12 | ideal.ing.nl |
www.servicenets.nl
|
| 1 | www.servicenets.nl | |
| 0 | mon.retail.ing.nl Failed |
www.servicenets.nl
|
| 14 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.ing.nl |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://www.servicenets.nl/vc/methode.html
Frame ID: A98194A4060AA32269E157EF3E37F9D6
Requests: 14 HTTP requests in this frame
Screenshot
Detected technologies
UNIX
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Unix/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
SiteCatalyst
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /\/s[_-]code.*\.js/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: http://www.ing.nl/de-ing/veilig-bankieren/veilig-internetbankieren/extra-veiligheid-met-de-PAC-code/index.aspx
Title: Help
Title: Help
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
methode.html
www.servicenets.nl/vc/ |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ses_ideal.css
ideal.ing.nl/internetbankieren/css/ |
813 B 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ses_style_v7.css
ideal.ing.nl/internetbankieren/css/ |
37 KB 38 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.7.1.min.js
ideal.ing.nl/internetbankieren/js/ |
92 KB 93 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ses_functions_v5.js
ideal.ing.nl/internetbankieren/js/ |
4 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ses_pacvalidation_v3.js
ideal.ing.nl/internetbankieren/js/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SES_logo_ing.gif
ideal.ing.nl/internetbankieren/gfx/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pixel.gif
ideal.ing.nl/internetbankieren/gfx/ |
42 B 349 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
s_code_sol.js
ideal.ing.nl/internetbankieren/js/ |
12 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SOL_1px_transparent.gif
ideal.ing.nl/internetbankieren/css/images/ |
42 B 349 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SES_icon_sprite_v2.png
ideal.ing.nl/internetbankieren/css/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SOL_gradients_sprite.png
ideal.ing.nl/internetbankieren/css/images/ |
200 B 508 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SES_icon_sprite_notifications.png
ideal.ing.nl/internetbankieren/css/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
ntpagetag.gif
mon.retail.ing.nl/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- mon.retail.ing.nl
- URL
- http://mon.retail.ing.nl/ntpagetag.gif?js=1&ts=1523143892263.417&lc=http%3A%2F%2Fwww.servicenets.nl%2Fvc%2Fmethode.html&rs=1600x1200&cd=24&ln=en&tz=GMT&jv=0&environment=P&RGB_nummer=HPBZHIB&customer_id=HPBZHIB&site=GIA&pagename=cli%3AInloggen%20iDeal%20desktop%3APAC-code%20invullen%3AU%20wordt%20gebeld&oc=closed&segment=ideal&language=dutch&java_script_version=OTP121026&resolution=1280%20and%20higher
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| show_layover function| show_tooltip function| hide_layover function| hide_tooltip function| hide_notificationballoon function| load_data object| s string| NTPT_GLBLEXTRA boolean| requestSent string| foldBuffer string| unfoldBuffer string| cmsBmPath string| BmResolution string| result function| ntptEventTag function| ntptLinkTag function| ntptSubmitTag string| OO00O number| O000O00 string| s_pageName undefined| s_form undefined| s_formStep undefined| s_formResult undefined| s_error0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ideal.ing.nl
mon.retail.ing.nl
www.servicenets.nl
mon.retail.ing.nl
145.221.182.225
81.169.145.72
1ec33826d05f4dda21136bf9142711bbf9dcebae3d51335edc8b774a4d11c309
27a1f073f774f038941b52de623f76049c404ce0e244060bab648104c124b700
358bd58ac4cd52f1deeff44455487b60eb9dffd176b6c0470e9315b7cd412647
4f9a2c981fc77eef390bb539c5e61a60c364a8c60688c2ff73a12d1e3d4e623f
6bde7d708981a95ba39db6872eb9aec7a118dd0027c79b59b5dee5dde51d9f10
7389c59a41c5f333280c784804643b4288b7780d67629004b237ff3a375fe18a
8b975bfc36afe47a30bbb78e9be9c2bd223de67ec0421e0f6d7e3ba6c954f273
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
d76ed04a6029944ae0bf6e49f4063f65a53b4b9a03b99bb7d971be86e1fcacb1
ebc2bec5abaab0906634207c008b8e969341d120fade59c0c31270c776b2e062
f4270cd8aaa654b7ff6c695b82ce3f8b19464e05ac2f889612c8dd5c54c54936
f9408ea23972ed3724cc814de48d44369750c6022f204c711f9cdd4263d26856