urlscan.io logo urlscan.io
SecurityTrails logo

ver-productions.nl Open in urlscan Pro
2a01:7c8:eb:0:37:97:170:93  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://is.gd/vwLRcm
Effective URL: https://ver-productions.nl/aanmelden/inloggen
Submission: On March 17 via manual from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 2a01:7c8:eb:0:37:97:170:93, located in Netherlands and belongs to TRANSIP-AS Amsterdam, the Netherlands, NL. The main domain is ver-productions.nl.
TLS certificate: Issued by R3 on March 16th 2022. Valid for: 3 months.
This is the only time ver-productions.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 2a01:7c8:eb:0... 20857 (TRANSIP-A...)
4 145.221.182.225 15625 (ING-AS Am...)
6 2
Apex Domain
Subdomains		 Transfer
4 ing.nl
ideal.ing.nl — Cisco Umbrella Rank: 207968
209 KB
1 ver-productions.nl
ver-productions.nl
14 KB
1 stanwink.nl
stanwink.nl
348 B
1 is.gd
is.gd — Cisco Umbrella Rank: 72181
480 B
6 4
Domain Requested by
4 ideal.ing.nl ver-productions.nl
ideal.ing.nl
1 ver-productions.nl
1 stanwink.nl
1 is.gd 1 redirects
6 4

This site contains no links.

Subject Issuer Validity Valid
*.stanwink.nl
R3		 2022-03-16 -
2022-06-14		 3 months crt.sh
*.ver-productions.nl
R3		 2022-03-16 -
2022-06-14		 3 months crt.sh
ideal.ing.nl
Entrust Certification Authority - L1M		 2020-08-17 -
2022-09-29		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://ver-productions.nl/aanmelden/inloggen
Frame ID: 98891198AD739EE0465C2F5657EEC6E8
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Mobiel Bankieren verlengen

Page URL History Show full URLs

  1. https://is.gd/vwLRcm HTTP 301
    https://stanwink.nl/schoonmaak/ Page URL
  2. https://ver-productions.nl/aanmelden/inloggen Page URL

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

223 kB
Transfer

714 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://is.gd/vwLRcm HTTP 301
    https://stanwink.nl/schoonmaak/ Page URL
  2. https://ver-productions.nl/aanmelden/inloggen Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://is.gd/vwLRcm HTTP 301
  • https://stanwink.nl/schoonmaak/

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
stanwink.nl/schoonmaak/
Redirect Chain
  • https://is.gd/vwLRcm
  • https://stanwink.nl/schoonmaak/
139 B
348 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stanwink.nl/schoonmaak/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:7c8:eb:0:37:97:170:93 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software
Apache /
Resource Hash
a681a4ff8f044dc1c1c645e51ffe4f8a4e479ebb6d3beef90871a7a0c80261f0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9

Response headers

Date
Thu, 17 Mar 2022 08:03:51 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
X-TransIP-Backend
web911
X-TransIP-Balancer
balancer7

Redirect headers

date
Thu, 17 Mar 2022 08:03:51 GMT
content-type
text/html; charset=UTF-8
location
https://stanwink.nl/schoonmaak/
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kt9i%2BGObjS4gAu3NuCuKHmOWcaEfKRYXlzw3Bznb%2FZ5iPB1keQ5jEZBDKPjBHxuv0qsL8RlZxdaFEgqcBitQywslbucEEJEKLqz0Yryp8oK2EQ1pZRX8fAmO4aW389WkVks1"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6ed436e7fa849bb6-FRA
Primary Request inloggen
ver-productions.nl/aanmelden/ 		13 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ver-productions.nl/aanmelden/inloggen
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a01:7c8:eb:0:37:97:170:93 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL),
Reverse DNS
Software
Apache /
Resource Hash
fc9fde4a712c31bb626a5e861d5a895692ead750faf84cd34ce696c3ce7bed27

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9
Referer
https://stanwink.nl/

Response headers

Date
Thu, 17 Mar 2022 08:03:51 GMT
Server
Apache
Content-Location
inloggen.php
Vary
negotiate
TCN
choice
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
X-TransIP-Backend
web911
X-TransIP-Balancer
balancer1
the-guide-styles-responsive.min.css
ideal.ing.nl/ideal/static/inloggen/the-guide/css/ 		565 KB
66 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Requested by
Host: ver-productions.nl
URL: https://ver-productions.nl/aanmelden/inloggen
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
df789e8fe20b63d56d8b1933b5da0e15b25e43d77eecf1c5a948c4110b8a2279
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://ver-productions.nl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 17 Mar 2022 08:03:52 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
text/css
Cache-Control
no-cache
Transfer-Encoding
chunked
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security
max-age=31622400; includeSubDomains
X-ING-Response-ID
144ca515-c818-45e4-aa97-0f618459f596
X-XSS-Protection
1; mode=block
INGMeWeb-Regular.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		36 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Regular.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
4a0a7668aaa847d33f49023d0982c6331bc9705cad2586eccb8086a680ef534c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://ver-productions.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 17 Mar 2022 08:03:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
62c5e065-59c0-4865-81af-c7482a9dcc13
Vary
Origin
Content-Length
37344
X-XSS-Protection
1; mode=block
ing-icons-v4-5.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		62 KB
64 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ing-icons-v4-5.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
48d8fe3abbdf6620a0203bdb4da7f57621b8f478cdbd054230638233cede2aae
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://ver-productions.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 17 Mar 2022 08:03:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
475e23fc-de44-4f14-8ff8-9d490a2516d0
Vary
Origin
Content-Length
63620
X-XSS-Protection
1; mode=block
INGMeWeb-Bold.woff
ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/ 		37 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ideal.ing.nl/ideal/static/inloggen/the-guide/fonts/woff/INGMeWeb-Bold.woff
Requested by
Host: ideal.ing.nl
URL: https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.221.182.225 , Netherlands, ASN15625 (ING-AS Amsterdam, NL),
Reverse DNS
Software
/
Resource Hash
e5cb35bd410aba4b717a1cc46814a88b50ff311f9514630dffa3480cb43b92e0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Strict-Transport-Security max-age=31622400; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ideal.ing.nl/ideal/static/inloggen/the-guide/css/the-guide-styles-responsive.min.css
Origin
https://ver-productions.nl
Accept-Language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 17 Mar 2022 08:03:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 07 Dec 2020 12:17:54 GMT
Strict-Transport-Security
max-age=31622400; includeSubDomains
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Access-Control-Allow-Credentials
false
Content-Security-Policy
default-src 'self'; prefetch-src 'self'; font-src 'self' data:; base-uri 'self'; object-src 'none'; frame-ancestors 'self' api.ideal.ing.nl; form-action 'self' api.ideal.ing.nl; upgrade-insecure-requests; block-all-mixed-content; connect-src 'self' api.ideal.ing.nl https://services.measureworks.nl; style-src 'self' 'unsafe-inline' data:; img-src https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' api.ideal.ing.nl tms.ingservices.nl data:; frame-src 'self' api.ideal.ing.nl https://aweucn1-2.advanced-web-analytics.com
Connection
keep-alive
Accept-Ranges
bytes
X-ING-Response-ID
108dbe7f-afac-47ec-a4d2-623a2b7767c2
Vary
Origin
Content-Length
38292
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

2 Cookies

Domain/Path Name / Value
.ideal.ing.nl/ Name: T-SESSION-ID
Value: 3q3L2glaPzhEJb1a3lZkiVkLrQZcS5RlgO4FGSr0hsF-4HGR64Wl7gWxtwmyK-Ik
.ing.nl/ Name: C-SESSION-ID
Value: 26457JXITnnxkC1mKTxV7KXm8vx7SitHsXe1dTNO522SSPxvRdqYQvy0037167364008E0EA58879B1A1