prosnetworking.dlmultimedia.org Open in urlscan Pro
162.241.85.172 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://prosnetworking.dlmultimedia.org/HOME/ActualizatBank/login-b/?82c4a825
Submission: On April 19 via manual (April 19th 2022, 5:12:35 am UTC) from IN — Scanned from DE

Summary HTTP 2 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 162.241.85.172, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is prosnetworking.dlmultimedia.org.
TLS certificate: Issued by R3 on March 25th 2022. Valid for: 3 months.

This is the only time prosnetworking.dlmultimedia.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	162.241.85.172 162.241.85.172	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	193.17.195.46 193.17.195.46	34022 (INGRO-AS) (INGRO-AS)
2	3

1 162.241.85.172 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-85-172.unifiedlayer.com

prosnetworking.dlmultimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.17.195.46 (Romania)

ASN34022 (INGRO-AS, RO)
PTR: www.homebank.ro

www.homebank.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	homebank.ro www.homebank.ro — Cisco Umbrella Rank: 397650
1	dlmultimedia.org prosnetworking.dlmultimedia.org	743 KB
2	2

	Domain	Requested by
1	www.homebank.ro	prosnetworking.dlmultimedia.org
1	prosnetworking.dlmultimedia.org
2	2

This site contains links to these domains. Also see Links.

Domain
ing.ro
www.homebank.ro
www.ing.ro
www.facebook.com
www.instagram.com
twitter.com
www.youtube.com
www.ing.jobs
www.anpc.gov.ro

Subject Issuer	Validity	Valid
www.prosnetworking.dlmultimedia.org R3	`2022-03-25` - `2022-06-23`	3 months	crt.sh
homebank.ro Entrust Certification Authority - L1M	`2022-02-11` - `2023-03-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://prosnetworking.dlmultimedia.org/HOME/ActualizatBank/login-b/?82c4a825
Frame ID: B470797ACCEEEB5DCCDC60237A947915
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ING Home'Bank - prin internet banking gestionezi rapid banii

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

859 kB
Transfer

1805 kB
Size

0
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://ing.ro/

Search URL Search Domain Scan URL

URL: https://www.homebank.ro/

Search URL Search Domain Scan URL

URL: https://www.homebank.ro/hb/hb/#/services/homebank/activate
Title: Activează-l acum!

Search URL Search Domain Scan URL

URL: https://www.ing.ro/persoane-fizice/internet-banking/homebank.html#faq/#siguranta
Title: Serviciu securizat cu 3 niveluri de securitate

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/contact
Title: Relaţii cu clienţii

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/informatii-utile/securitate
Title: Securitate

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/contact#harta
Title: Sucursale şi ATM-uri

Search URL Search Domain Scan URL

URL: https://www.ing.ro/dam/jcr:256ba7d7-9e72-4ed9-ad2f-228df74c1517/taxe_comisioane.pdf
Title: Taxe şi comisioane

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/informatii-utile/curs-valutar
Title: Curs valutar

Search URL Search Domain Scan URL

URL: https://ing.ro/dam/ingro/doc/contractuale/pers-fizice/ghidul-platilor-20190423.pdf
Title: Tabel Cut off time

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/informatii-utile/solutionare-litigii-cu-banca
Title: Reclamaţii şi petiţii

Search URL Search Domain Scan URL

URL: https://ing.ro/ing-in-romania/informatii-utile/documente-contractuale
Title: Documente contractuale

Search URL Search Domain Scan URL

URL: http://www.facebook.com/INGWebCafe
Title: /ingromania

Search URL Search Domain Scan URL

URL: https://www.instagram.com/ingromania/
Title: /ingromania

Search URL Search Domain Scan URL

URL: https://twitter.com/ing_ro
Title: /ING Romania

Search URL Search Domain Scan URL

URL: http://www.youtube.com/user/ingbankromania
Title: /ING Romania

Search URL Search Domain Scan URL

URL: https://www.ing.ro/dam/jcr:4e61c812-e255-4780-9786-38ce0c00adbd/rate_dobanzi.pdf
Title: Rate şi dobânzi

Search URL Search Domain Scan URL

URL: https://www.ing.jobs/Romania/Acasa.htm
Title: Cariere

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/relatii-cu-media
Title: Relaţii cu media

Search URL Search Domain Scan URL

URL: http://www.anpc.gov.ro/
Title: ANPC

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/informatii-utile/confidentialitate
Title: Confidenţialitate

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/informatii-utile/mifid
Title: MiFID

Search URL Search Domain Scan URL

URL: https://www.ing.ro/ing-in-romania/informatii-utile/promotii
Title: Promoţii

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
13 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response prosnetworking.dlmultimedia.org/HOME/ActualizatBank/login-b/	1 MB 743 KB	1191ms 416ms	Document text/html	162.241.85.172 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://prosnetworking.dlmultimedia.org/HOME/ActualizatBank/login-b/?82c4a825 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.172 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-172.unifiedlayer.com Software Apache / Resource Hash `75ada2ede1baecef79a085de60a92144a4512b8092b177c4ecb94882fd369cca` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 19 Apr 2022 05:12:25 GMT server Apache vary Accept-Encoding
GET DATA	200 OK	truncated /	68 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f8a612bc01431507ffadb91f3cfd90d4356d198f413f759337eaa33ea01c6f75` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	905 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `061502dc7afa31effc647970e0ad46b4c0abe78085556d3ccdf5ffd21a8e6aaa` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `20b74c733a7a3424e81a6b1e7326089c8d18f82e32743da0d997b4592ff47c03` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1114f3821b29756a2e3d9c49d9e30a0f394749cb0e324485c40f3b24fcc424ff` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	30 KB 30 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e` Request headers Referer Origin https://prosnetworking.dlmultimedia.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	29 KB 29 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155` Request headers Referer Origin https://prosnetworking.dlmultimedia.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	192 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e8323bf8a1968e0a2c1fc710c82c12a202559c98d2671c3e06b7488f05a26da3` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `740f75d95ec2429f6f51f3dbc35d5e7347639e2c43ce46e970ea3f4462fb43e8` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bda493e7bf82c322bdb5c7e577b149cf4e4fca4709dd8eba7e2c9174fe90e9f8` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	55 KB 55 KB		Font application/font-sfnt
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3ecd0ca89f4e10d74aace7ca2dc9a7d3ee2439146d590b50c54bd095fce79f29` Request headers Referer Origin https://prosnetworking.dlmultimedia.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type application/font-sfnt
GET DATA	200 OK	truncated /	3 KB 3 KB		Font application/font-sfnt
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6727c4e528fb3ba23d5d083a2663b5a02ce76b9a028467e9e5b97382ac4f06ae` Request headers Referer Origin https://prosnetworking.dlmultimedia.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type application/font-sfnt
GET H/1.1	200 OK	/ www.homebank.ro/Epfxn0/	0 0	219ms 39ms	Image text/html	193.17.195.46 INGRO-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.homebank.ro/Epfxn0/?id=hbspa&c=im&phg=72Ujg8YfD70m Requested by Host: prosnetworking.dlmultimedia.org URL: https://prosnetworking.dlmultimedia.org/HOME/ActualizatBank/login-b/?82c4a825 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.17.195.46 , Romania, ASN34022 (INGRO-AS, RO), Reverse DNS www.homebank.ro Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://prosnetworking.dlmultimedia.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers
GET DATA	200 OK	truncated /	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

prosnetworking.dlmultimedia.org
www.homebank.ro
162.241.85.172
193.17.195.46
061502dc7afa31effc647970e0ad46b4c0abe78085556d3ccdf5ffd21a8e6aaa
1114f3821b29756a2e3d9c49d9e30a0f394749cb0e324485c40f3b24fcc424ff
20b74c733a7a3424e81a6b1e7326089c8d18f82e32743da0d997b4592ff47c03
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
3ecd0ca89f4e10d74aace7ca2dc9a7d3ee2439146d590b50c54bd095fce79f29
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6727c4e528fb3ba23d5d083a2663b5a02ce76b9a028467e9e5b97382ac4f06ae
740f75d95ec2429f6f51f3dbc35d5e7347639e2c43ce46e970ea3f4462fb43e8
75ada2ede1baecef79a085de60a92144a4512b8092b177c4ecb94882fd369cca
bda493e7bf82c322bdb5c7e577b149cf4e4fca4709dd8eba7e2c9174fe90e9f8
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8323bf8a1968e0a2c1fc710c82c12a202559c98d2671c3e06b7488f05a26da3
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155
f8a612bc01431507ffadb91f3cfd90d4356d198f413f759337eaa33ea01c6f75

prosnetworking.dlmultimedia.org Open in urlscan Pro 162.241.85.172 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

859 kBTransfer

1805 kBSize

0 Cookies

23 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

prosnetworking.dlmultimedia.org Open in urlscan Pro
162.241.85.172 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

859 kB
Transfer

1805 kB
Size

0
Cookies

2 HTTP transactions
13 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!