urlscan.io logo urlscan.io
SecurityTrails logo

myaccount.ing.com Open in urlscan Pro
145.221.213.252  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://myaccount.ing.com/
Effective URL: https://myaccount.ing.com/
Submission: On June 14 via manual from PL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 22 HTTP transactions. The main IP is 145.221.213.252, located in Netherlands and belongs to ING-AS Amsterdam, NL. The main domain is myaccount.ing.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on March 11th 2022. Valid for: a year.
This is the only time myaccount.ing.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 21 145.221.213.252 15625 (ING-AS Am...)
2 145.221.213.230 15625 (ING-AS Am...)
22 3
Apex Domain
Subdomains		 Transfer
23 ing.com
myaccount.ing.com
api.myaccount.ing.com
418 KB
22 1
Domain Requested by
21 myaccount.ing.com 1 redirects myaccount.ing.com
2 api.myaccount.ing.com myaccount.ing.com
22 2

This site contains no links.

Subject Issuer Validity Valid
myaccount.ing.com
Entrust Certification Authority - L1M		 2022-03-11 -
2023-03-30		 a year crt.sh
api.myaccount.ing.com
Entrust Certification Authority - L1M		 2021-07-23 -
2022-08-06		 a year crt.sh

This page contains 1 frames:

Primary Page: https://myaccount.ing.com/
Frame ID: B83EFEFBB140FA080A3532895C83C29C
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

ING MyAccount

Page URL History Show full URLs

  1. http://myaccount.ing.com/ HTTP 302
    https://myaccount.ing.com/ Page URL

Page Statistics

22
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

3
IPs

1
Countries

417 kB
Transfer

2177 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://myaccount.ing.com/ HTTP 302
    https://myaccount.ing.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
myaccount.ing.com/
Redirect Chain
  • http://myaccount.ing.com/
  • https://myaccount.ing.com/
6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
cb4eefccb26aaf327e10fbd50ce2a661479597384baa0b0450cdf3f4f0a49bfd
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Cache-Control
no-cache
Connection
keep-alive
Content-Encoding
br
Content-Length
1574
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Content-Type
text/html
Date
Tue, 14 Jun 2022 08:37:04 GMT
ETag
"121F18CC9EC39F3E"
Last-Modified
Tue, 29 Mar 2022 15:11:46 GMT
Referrer-Policy
no-referrer-when-downgrade
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
deny
X-XSS-Protection
1; mode=block

Redirect headers

Connection
Keep-Alive
Content-Length
0
Location
https://myaccount.ing.com/
Server
BigIP
1648565370365_fcf6ed67.js
myaccount.ing.com/ 		839 KB
156 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/1648565370365_fcf6ed67.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
cc1f1c44a691725b728878d6c761ac96d299e0033759a5f1608cfa81ae8e7ec8
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:46 GMT
ETag
"10D43C3C879A683D"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
158597
X-Content-Type-Options
nosniff
main.js
myaccount.ing.com/node_modules/ing-util-scr-session/assets/ 		79 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-util-scr-session/assets/main.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
3569bc3655cf04855f8f64e44dd67e933fa0229c36a2dcfd2625be823386342a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:47 GMT
ETag
"E913510E0211B61F"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
15817
X-Content-Type-Options
nosniff
INGMeWeb-Regular.woff2
myaccount.ing.com/node_modules/ing-web/assets/INGMe/Regular/ 		29 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-web/assets/INGMe/Regular/INGMeWeb-Regular.woff2
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://myaccount.ing.com/
Origin
https://myaccount.ing.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:49 GMT
ETag
"459C2BDC5CBB4A56"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
font/woff2
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
29563
X-Content-Type-Options
nosniff
systemjs.6744a76d48d4fcc398208e8269c87aa1.js
myaccount.ing.com/polyfills/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/polyfills/systemjs.6744a76d48d4fcc398208e8269c87aa1.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
183db9de33094943ded289e4198202505efbace7a32fdd5a98ab66b4b5c2793d
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:47 GMT
ETag
"76FFB8DA1B2777D6"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
2709
X-Content-Type-Options
nosniff
1648565370365_e566f017.js
myaccount.ing.com/ 		931 KB
110 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/1648565370365_e566f017.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/polyfills/systemjs.6744a76d48d4fcc398208e8269c87aa1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
ce2bdbd56bcb2eacfa727217c264f051daa3dc5606e2f264d6d3142bfa4dbbd4
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:46 GMT
ETag
"93F5CC4FFE20AA60"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
111097
X-Content-Type-Options
nosniff
1648565370365_9624a90e.js
myaccount.ing.com/ 		87 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/1648565370365_9624a90e.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/polyfills/systemjs.6744a76d48d4fcc398208e8269c87aa1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
88b695ac78fbfb89b897735c18f64c38f8714b63e26c7179b4b1cee447974fe3
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:46 GMT
ETag
"484ECB4BDE219EB4"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
15784
X-Content-Type-Options
nosniff
1648565370365_21ea2761.js
myaccount.ing.com/ 		56 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/1648565370365_21ea2761.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/polyfills/systemjs.6744a76d48d4fcc398208e8269c87aa1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
83adb8c66439f47e96e7b25539998c0bca020dbe72a94bab48b394e0ff157c92
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:46 GMT
ETag
"559DBF8D865C90C8"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
8363
X-Content-Type-Options
nosniff
1648565370365_9e9b29bc.js
myaccount.ing.com/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/1648565370365_9e9b29bc.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/polyfills/systemjs.6744a76d48d4fcc398208e8269c87aa1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
440cd1d50bad08c8e9b618c8ba90754c2aa926f64eb3456ebd84934810fea850
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:46 GMT
ETag
"F48883B642C2E26C"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
519
X-Content-Type-Options
nosniff
1648565370365_813844e0.js
myaccount.ing.com/ 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/1648565370365_813844e0.js
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/polyfills/systemjs.6744a76d48d4fcc398208e8269c87aa1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
85e2c6b7a79fa2aad6df763ee03823a88c1b6923fb44e1f327b40c7864ef4400
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:46 GMT
ETag
"E16BEC7FF5DE6449"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
application/javascript
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
1537
X-Content-Type-Options
nosniff
countries
api.myaccount.ing.com/grants/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.myaccount.ing.com/grants/countries
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.230 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
api.myaccount.ing.nl
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self' https:; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self'; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' data:
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
x-xsrf-token
Access-Control-Request-Method
GET
Origin
https://myaccount.ing.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
authority, authorization, cache-control, content-type, dtab-local, expect, language, pragma, sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-fetch-dest, sec-fetch-mode, sec-fetch-site, sec-fetch-user, sec-gpc, sec-metadata, sec-websocket-extensions, sec-websocket-key, sec-websocket-protocol, sec-websocket-version, te, tppauthorisation, ua-color, ua-cpu, ua-disp, ua-os, ua-pixels, upgrade, via, vnd.ing.ext.ctx-app_id, vnd.ing.ext.ctx-graphite_postfix, x-ing-accessprofiletype, x-ing-crontoencryptedstate, x-ing-fingerprint, x-ing-user-inactivity, x-p2p-peerdist, x-p2p-peerdistex, x-request-id, x-xsrf-token
Access-Control-Allow-Methods
GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin
https://myaccount.ing.com
Access-Control-Expose-Headers
location,x-token-expired,x-token-loa,x-token-scope,cache-control,content-disposition,x-ing-crontoencryptedstate,tpp-redirect-uri,x-ing-response-id,x-request-id
Access-Control-Max-Age
600
Connection
keep-alive
Content-Security-Policy
default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self' https:; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self'; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' data:
Date
Tue, 14 Jun 2022 08:37:04 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Vary
Origin
X-Content-Type-Options
nosniff
X-Frame-Options
sameorigin
X-ING-Response-ID
b1d3ebf2-2ff9-4f02-bc49-421383195c97
X-XSS-Protection
1; mode=block
be-means-cap-ucr-icon.svg
myaccount.ing.com/node_modules/ing-orange-be-ucr-authentication/assets/images/ 		79 KB
17 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-be-ucr-authentication/assets/images/be-means-cap-ucr-icon.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
273a3d01475d66702d46139378f710503e9681637afc196227220e9610dbd251
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"91C3AB9598F48ADB"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
16259
X-Content-Type-Options
nosniff
connected-card-reader-logo.svg
myaccount.ing.com/node_modules/ing-orange-be-scr-authentication/assets/images/ 		12 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-be-scr-authentication/assets/images/connected-card-reader-logo.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
181ee8202608cf4a79b9749aab0f138366abeb522deb65b926145c95494aec62
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"6DAFE6F3991DA87B"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
2865
X-Content-Type-Options
nosniff
isabel-logo.svg
myaccount.ing.com/node_modules/ing-orange-be-isabel-authentication/assets/images/ 		4 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-be-isabel-authentication/assets/images/isabel-logo.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
53828a091859bf4f197dcc18ffdabe97f0c8860a1bc5bd3bc1bcc991a6244bd1
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"5C1887A7155579AE"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
1688
X-Content-Type-Options
nosniff
icon-luxtrust-token.svg
myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-token-authentication/assets/images/ 		2 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-token-authentication/assets/images/icon-luxtrust-token.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
0a9eced4dd7663847a96c3fa5a9963a5f135213255e404232be1056812fdda2c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"CC5BF1315B0DEC14"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
641
X-Content-Type-Options
nosniff
icon-luxtrust-app.svg
myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-mobile-authentication/assets/images/ 		1 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-mobile-authentication/assets/images/icon-luxtrust-app.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
f7e3047799f38bd4cf0be3e7563361506073158f0ba3c691b09cea5e8148ea1c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"123799A40EE35EB1"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
468
X-Content-Type-Options
nosniff
icon-luxtrust-scan.svg
myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-scan-authentication/assets/images/ 		1 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-scan-authentication/assets/images/icon-luxtrust-scan.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
5b803a41ffa0f391469275fae4ffd49264ab6bec00f4fe91b5c4c1b36281b550
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"2DC2B08310F0F161"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
438
X-Content-Type-Options
nosniff
icon-luxtrust-card.svg
myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-smartcard-authentication/assets/images/ 		817 B
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-smartcard-authentication/assets/images/icon-luxtrust-card.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
ab57fb0207bd6ac8a345d76c75ef7947e19064b29919a88057e4cda10b68b1f8
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"428AF83B1AA47A17"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
382
X-Content-Type-Options
nosniff
icon-luxtrust-stick.svg
myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-stick-authentication/assets/images/ 		836 B
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-orange-lu-luxtrust-stick-authentication/assets/images/icon-luxtrust-stick.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_21ea2761.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
f6ab3eede295a2ad426ee9e37266f5d130cf04e5080e54cc420f1cd458f3e847
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"F17D2642C1F5C6D1"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
414
X-Content-Type-Options
nosniff
countries
api.myaccount.ing.com/grants/ 		75 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.myaccount.ing.com/grants/countries
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/1648565370365_fcf6ed67.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.230 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
api.myaccount.ing.nl
Software
/
Resource Hash
1df55d6574585f53341a3c40aed2cca03de62900ba0fcfa8e8a480ef15c6ce45
Security Headers
Name Value
Content-Security-Policy default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self' https:; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self'; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' data:
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/plain, */*
Referer
https://myaccount.ing.com/
X-XSRF-TOKEN
HLqYXpR3SeFMRovvofAfaH1iKl7HVH1AffKQHlXwRV3NB-p2MyeH5T2jVnOwlXKP
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
keep-alive
X-XSS-Protection
1; mode=block
X-Frame-Options
sameorigin
Vary
Origin
Content-Type
application/json;charset=UTF-8
Access-Control-Allow-Origin
https://myaccount.ing.com
Access-Control-Expose-Headers
location,x-token-expired,x-token-loa,x-token-scope,cache-control,content-disposition,x-ing-crontoencryptedstate,tpp-redirect-uri,x-ing-response-id,x-request-id
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Content-Security-Policy
default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self' https:; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self'; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' data: 'unsafe-inline' 'unsafe-eval' data:
X-ING-Response-ID
40773d24-9242-48a8-bad3-27c8cc034d7d
Expires
Tue, 14 Jun 2022 08:37:04 GMT
ingWaitingScreen.svg
myaccount.ing.com/node_modules/ing-message-screen/assets/images/ 		7 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myaccount.ing.com/node_modules/ing-message-screen/assets/images/ingWaitingScreen.svg
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
caff6875a1bd2ef792d9d55246d9805c808dba63fbba7e1066a9c7660aedc99e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://myaccount.ing.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:48 GMT
ETag
"F557204EE7618AE7"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
image/svg+xml
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
2874
X-Content-Type-Options
nosniff
INGMeWeb-Bold.woff2
myaccount.ing.com/node_modules/ing-web/assets/INGMe/Bold/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://myaccount.ing.com/node_modules/ing-web/assets/INGMe/Bold/INGMeWeb-Bold.woff2
Requested by
Host: myaccount.ing.com
URL: https://myaccount.ing.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.213.252 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://myaccount.ing.com/
Origin
https://myaccount.ing.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Tue, 14 Jun 2022 08:37:04 GMT
Content-Encoding
br
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Tue, 29 Mar 2022 15:11:49 GMT
ETag
"98F4EAA1C215678C"
X-Frame-Options
deny
Connection
keep-alive
Content-Type
font/woff2
X-XSS-Protection
1; mode=block
Cache-Control
no-cache
Content-Security-Policy
default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security
max-age=31622400; includeSubDomains; preload
Vary
Accept-Encoding
Content-Length
30407
X-Content-Type-Options
nosniff
truncated
/ 		171 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe63f0ce5d9bb4f26ffb53b59a14ab9bf38bdc366a1fa848e1dfcf802a97e383

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| SConnectBrowserDetect object| SConnectSupportConfig function| SConnectValidation function| SConnect number| eventHash function| SCardScope function| SCardAccessMode function| SCardProtocolIdentifiers function| SCardDisposition function| SCardState object| enex object| SCRJsonObject object| SCRConfiguration object| ING object| System object| litHtmlVersions function| JSCompiler_renameProperty object| litElementVersions string| ENV function| resolveITP function| _ function| axios

8 Cookies

Domain/Path Name / Value
.myaccount.ing.com/ Name: XSRF-TOKEN
Value: HLqYXpR3SeFMRovvofAfaH1iKl7HVH1AffKQHlXwRV3NB-p2MyeH5T2jVnOwlXKP
myaccount.ing.com/ Name: fecvm
Value: 11.5.0
myaccount.ing.com/ Name: lb-4-p-219
Value: !yItd36rIMKa/mdWcXnHtSx8TvBjNNEwTU8tKoESK+aFSUgNobJFh5Vcv/MgH2p7rLRE+0JRTKY7bvEHFm4foEFQ01Kf4IJAaILuvjIi/uueS
myaccount.ing.com/ Name: TS019d407a
Value: 01a0dd1109fc83391ce6710a4ae50857d84d9b57c6a4dd311489f0fdbe289379520b60793106a0520b390a84f9ca5d1dc7b0ae6e6d
.myaccount.ing.com/ Name: TS017af1d0
Value: 01a0dd1109fc83391ce6710a4ae50857d84d9b57c6a4dd311489f0fdbe289379520b60793106a0520b390a84f9ca5d1dc7b0ae6e6d
api.myaccount.ing.com/ Name: T-SESSION-ID
Value: Px1jjXgUNDwwRZqWIJsi0aqVH9bcfG9ZXxLN8LCYZUGQ2D2fMtldpWLo57UvP8DO
api.myaccount.ing.com/ Name: lb-4-p-232
Value: !PYFzG/iICNkjVCqcXnHtSx8TvBjNNBQhNTuXGSHa7YLViSGzv8cOIXXHgRnKTTS2zeZRiSJmslvIHPYhXMVRBHee8RueXlrBCEixcAXhRR4=
api.myaccount.ing.com/ Name: TS019d407a
Value: 01a0dd110946a54590a3cea4a15cf2af34d07f079b8c484689c9429bcab67c9946dd0a2303f598d8e1b7fa7f29de40e96263a4c77d

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; prefetch-src 'self' blob: 'unsafe-inline' https://cdn.ing.com; font-src 'self' data: https://cdn.ing.com; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self' api.myaccount.ing.com; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.myaccount.ing.com; style-src 'self' 'unsafe-inline' data: https://cdn.ing.com; img-src https: data: https://cdn.ing.com; script-src 'self' data: api.myaccount.ing.com 'unsafe-inline' 'unsafe-eval' https://cdn.ing.com; frame-src 'self' api.myaccount.ing.com *.luxtrust.com https://aweucn1-2.advanced-web-analytics.com; media-src https://cdn.ing.com;
Strict-Transport-Security max-age=31622400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.myaccount.ing.com
myaccount.ing.com
145.221.213.230
145.221.213.252
0a9eced4dd7663847a96c3fa5a9963a5f135213255e404232be1056812fdda2c
181ee8202608cf4a79b9749aab0f138366abeb522deb65b926145c95494aec62
183db9de33094943ded289e4198202505efbace7a32fdd5a98ab66b4b5c2793d
1df55d6574585f53341a3c40aed2cca03de62900ba0fcfa8e8a480ef15c6ce45
273a3d01475d66702d46139378f710503e9681637afc196227220e9610dbd251
3569bc3655cf04855f8f64e44dd67e933fa0229c36a2dcfd2625be823386342a
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
440cd1d50bad08c8e9b618c8ba90754c2aa926f64eb3456ebd84934810fea850
53828a091859bf4f197dcc18ffdabe97f0c8860a1bc5bd3bc1bcc991a6244bd1
5b803a41ffa0f391469275fae4ffd49264ab6bec00f4fe91b5c4c1b36281b550
83adb8c66439f47e96e7b25539998c0bca020dbe72a94bab48b394e0ff157c92
85e2c6b7a79fa2aad6df763ee03823a88c1b6923fb44e1f327b40c7864ef4400
88b695ac78fbfb89b897735c18f64c38f8714b63e26c7179b4b1cee447974fe3
ab57fb0207bd6ac8a345d76c75ef7947e19064b29919a88057e4cda10b68b1f8
caff6875a1bd2ef792d9d55246d9805c808dba63fbba7e1066a9c7660aedc99e
cb4eefccb26aaf327e10fbd50ce2a661479597384baa0b0450cdf3f4f0a49bfd
cc1f1c44a691725b728878d6c761ac96d299e0033759a5f1608cfa81ae8e7ec8
ce2bdbd56bcb2eacfa727217c264f051daa3dc5606e2f264d6d3142bfa4dbbd4
f6ab3eede295a2ad426ee9e37266f5d130cf04e5080e54cc420f1cd458f3e847
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155
f7e3047799f38bd4cf0be3e7563361506073158f0ba3c691b09cea5e8148ea1c
fe63f0ce5d9bb4f26ffb53b59a14ab9bf38bdc366a1fa848e1dfcf802a97e383