urlscan.io logo urlscan.io
SecurityTrails logo

miasanoixu.cfolks.pl Open in urlscan Pro
185.208.164.24  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://miasanoixu.cfolks.pl/ing/
Submission: On June 12 via manual from ES — Scanned from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 185.208.164.24, located in Poland and belongs to CF-GDA, PL. The main domain is miasanoixu.cfolks.pl.
TLS certificate: Issued by Certum Domain Validation CA SHA2 on August 3rd 2022. Valid for: a year.
This is the only time miasanoixu.cfolks.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
6 185.208.164.24 41079 (CF-GDA)
1 69.16.175.10 20446 (STACKPATH...)
1 193.41.234.21 16289 (ING-DIREC...)
8 3
Apex Domain
Subdomains		 Transfer
6 cfolks.pl
miasanoixu.cfolks.pl
80 KB
1 ingdirect.es
ing.ingdirect.es — Cisco Umbrella Rank: 738117
22 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 768
30 KB
8 3
Domain Requested by
6 miasanoixu.cfolks.pl miasanoixu.cfolks.pl
1 ing.ingdirect.es miasanoixu.cfolks.pl
1 code.jquery.com miasanoixu.cfolks.pl
8 3

This site contains no links.

Subject Issuer Validity Valid
*.cfolks.pl
Certum Domain Validation CA SHA2		 2022-08-03 -
2023-08-03		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh
ing.ingdirect.es
Entrust Certification Authority - L1M		 2022-06-13 -
2023-07-11		 a year crt.sh

This page contains 1 frames:

Primary Page: https://miasanoixu.cfolks.pl/ing/
Frame ID: 9B62580847BA3C11FC53614A26BFE05D
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Acceso clientes, ING

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

111 kB
Transfer

211 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
miasanoixu.cfolks.pl/ing/ 		16 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://miasanoixu.cfolks.pl/ing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.208.164.24 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS
s24.cyber-folks.pl
Software
LiteSpeed /
Resource Hash
b1c6b16c89f0c078a7fd7e693f566c2aea0d72f6417ca29f76ad79d93744bb69

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
3292
content-type
text/html
date
Mon, 12 Jun 2023 11:28:53 GMT
etag
"4145-5ee56ae8-d435a6b3fefb8835;br"
last-modified
Sun, 14 Jun 2020 00:10:16 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
styles.css
miasanoixu.cfolks.pl/ing/ 		15 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://miasanoixu.cfolks.pl/ing/styles.css
Requested by
Host: miasanoixu.cfolks.pl
URL: https://miasanoixu.cfolks.pl/ing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.208.164.24 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS
s24.cyber-folks.pl
Software
LiteSpeed /
Resource Hash
e008801612a41d04427fd522d313657cb123faf360e0a3821ac900c4b661f77e

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://miasanoixu.cfolks.pl/ing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Mon, 12 Jun 2023 11:28:54 GMT
content-encoding
br
last-modified
Sun, 14 Jun 2020 11:12:26 GMT
server
LiteSpeed
etag
"3ab6-5ee6061a-a52ad29a14f81b92;br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
4043
expires
Mon, 19 Jun 2023 11:28:54 GMT
jquery-3.5.1.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: miasanoixu.cfolks.pl
URL: https://miasanoixu.cfolks.pl/ing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
hwcdn.net
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
https://miasanoixu.cfolks.pl/
Origin
https://miasanoixu.cfolks.pl
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Mon, 12 Jun 2023 11:28:54 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-15d84"
vary
Accept-Encoding
x-hw
1686569334.dop201.wa1.t,1686569334.cds205.wa1.hn,1686569334.cds202.wa1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30879
main.js
miasanoixu.cfolks.pl/ing/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://miasanoixu.cfolks.pl/ing/main.js
Requested by
Host: miasanoixu.cfolks.pl
URL: https://miasanoixu.cfolks.pl/ing/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.208.164.24 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS
s24.cyber-folks.pl
Software
LiteSpeed /
Resource Hash
67db6306e67299fb89ef09489bd0a4be9ba0aa7a027eb7a0efb28b8dd8fd44b5

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://miasanoixu.cfolks.pl/ing/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Mon, 12 Jun 2023 11:28:54 GMT
content-encoding
br
last-modified
Fri, 26 May 2023 13:47:42 GMT
server
LiteSpeed
etag
"19e6-6470b87e-fc5ccb7711a33192;br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1640
expires
Mon, 19 Jun 2023 11:28:54 GMT
ing-lion-reversed.svg
miasanoixu.cfolks.pl/ing/ 		27 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miasanoixu.cfolks.pl/ing/ing-lion-reversed.svg
Requested by
Host: miasanoixu.cfolks.pl
URL: https://miasanoixu.cfolks.pl/ing/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.208.164.24 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS
s24.cyber-folks.pl
Software
LiteSpeed /
Resource Hash
6b3c4d3e255d73ca9e57959f5860c8357dbfad51249a6ee5a969c0d75f38f462

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://miasanoixu.cfolks.pl/ing/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Mon, 12 Jun 2023 11:28:54 GMT
content-encoding
br
last-modified
Thu, 04 Jun 2020 23:09:16 GMT
server
LiteSpeed
etag
"6c45-5ed97f1c-a71570c88c3a10ad;br"
vary
Accept-Encoding,User-Agent
content-type
image/svg+xml
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
12377
expires
Mon, 19 Jun 2023 11:28:54 GMT
logoING.svg
ing.ingdirect.es/app-login/assets/images/svg/ 		22 B
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ing.ingdirect.es/app-login/assets/images/svg/logoING.svg
Requested by
Host: miasanoixu.cfolks.pl
URL: https://miasanoixu.cfolks.pl/ing/styles.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
193.41.234.21 , Spain, ASN16289 (ING-DIRECT-SPAIN, ES),
Reverse DNS
Software
/
Resource Hash
e9e18797898538013a66ff759d88668598c674e0e5b6d1873c404a549640617d

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://miasanoixu.cfolks.pl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Mon, 12 Jun 2023 11:28:54 GMT
Connection
keep-alive
Content-Length
22
x-pool-ipc
dfwo
Content-Type
text/html
INGMeWeb-Regular.woff2
miasanoixu.cfolks.pl/ing/font/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://miasanoixu.cfolks.pl/ing/font/INGMeWeb-Regular.woff2
Requested by
Host: miasanoixu.cfolks.pl
URL: https://miasanoixu.cfolks.pl/ing/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.208.164.24 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS
s24.cyber-folks.pl
Software
LiteSpeed /
Resource Hash
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155

Request headers

Referer
https://miasanoixu.cfolks.pl/ing/styles.css
Origin
https://miasanoixu.cfolks.pl
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Mon, 12 Jun 2023 11:28:54 GMT
last-modified
Thu, 04 Jun 2020 23:04:44 GMT
server
LiteSpeed
etag
"73b0-5ed97e0c-214d9b3573df0d03;;;"
vary
User-Agent
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
29616
expires
Mon, 19 Jun 2023 11:28:54 GMT
INGMeWeb-Bold.woff2
miasanoixu.cfolks.pl/ing/font/ 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://miasanoixu.cfolks.pl/ing/font/INGMeWeb-Bold.woff2
Requested by
Host: miasanoixu.cfolks.pl
URL: https://miasanoixu.cfolks.pl/ing/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.208.164.24 , Poland, ASN41079 (CF-GDA, PL),
Reverse DNS
s24.cyber-folks.pl
Software
LiteSpeed /
Resource Hash
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e

Request headers

Referer
https://miasanoixu.cfolks.pl/ing/styles.css
Origin
https://miasanoixu.cfolks.pl
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date
Mon, 12 Jun 2023 11:28:54 GMT
last-modified
Thu, 04 Jun 2020 23:04:44 GMT
server
LiteSpeed
etag
"76f8-5ed97e0c-67ccc8422f2af78f;;;"
vary
User-Agent
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
30456
expires
Mon, 19 Jun 2023 11:28:54 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery function| isValidDate

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://ing.ingdirect.es/app-login/assets/images/svg/logoING.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)