Report - mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php

Report Overview

Submitted URL
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
IP
45.55.112.74
ASN
#14061 DIGITALOCEAN-ASN
Submitted
2024-04-25 13:21:53
Access
public
Website Title
ING Login
Final URL
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Tags
ing_bank financial phishing
urlquery detections
Phishing - ING Group

Detections

urlquery
26
Network Intrusion Detection
1
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mail-kundeservice-itsmezak9486503.codeanyapp.com	unknown	unknown	No data	No data	5.5 kB	1.3 MB	45.55.112.74
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-24	947 B	37 kB	104.17.25.14
maxcdn.bootstrapcdn.com	724	2012-05-25	2014-06-18	2024-04-24	468 B	50 kB	104.18.11.207

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-25 13:21:27	low	Client IP	45.55.112.74	ET INFO Observed Domain used for Phishing in TLS SNI (codeanyapp .com)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/jquery.min.js	91 kB	2023-03-07	2024-05-04
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/jquery.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:00 Last Seen2024-05-04 05:46:04 Times Seen1999 Hash a34f78c3aecd182144818eb4b7303fda 6fca78dac2797c02d86a4bf6514eda398b7dbe62 c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776 Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/jquery.validate.min.js	23 kB	2023-04-05	2024-05-04
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/jquery.validate.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 04:04:40 Last Seen2024-05-04 12:44:05 Times Seen765 Hash d099319695537f45ec0c6170e7474249 6f8064f9cfcb8c61b98bd386205372a1c92ab271 8e54b5540170341fcdef6cef9b3713a8a51bcbcdb3b558e2c52636e2280bb0c6 Loading...

	maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	49 kB	2023-03-07	2024-05-04
Pretty URL maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js IP 104.18.11.207 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:44 Last Seen2024-05-04 20:22:07 Times Seen138672 Hash 14d449eb8876fa55e1ef3c2cc52b0c17 a9545831803b1359cfeed47e3b4d6bae68e40e99 e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Loading...

	mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php	0 B	2023-03-07	2024-05-04
Pretty URL mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php IP 45.55.112.74 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 22:05:56 Times Seen37347318 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (12)

URL IP Response Size

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php

45.55.112.74

200 OK

3.1 kB

URL User Request GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
3.1 kB (3108 bytes)
Hash
79875069bb308e629891b3d1dfa16fac
1a9cd090d30217d49e59141c2534350b01630556
2595841c89edda3fc1d8b0cf3876e8c97f745c6b69b499586955e79b1f868325

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/login.php HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:37:59 GMT
content-type: text/html; charset=UTF-8
content-length: 3108
set-cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/jquery.min.js

104.17.25.14

200 OK

28 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/jquery.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (32764)
Size
28 kB (28293 bytes)
Hash
a34f78c3aecd182144818eb4b7303fda
6fca78dac2797c02d86a4bf6514eda398b7dbe62
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776

HTTP Headers

GET /ajax/libs/jquery/1.6.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 13:21:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 28293
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-164ce"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 44371
expires: Tue, 15 Apr 2025 13:21:28 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v%2FEVd2B6f0IW7w0%2FqeqUZvCaPuvLu0g0iQtMBe608Poe7MPIznmKpRzAEuQOdSHz2E0PBN5e0IfqvQtrsPLvgLNufSQC90MAWQi34rs4vXxMcKeA1CtHYHAIhcJ0mL5WFQ6Jd%2Bya"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 879ea2ea6fc6712f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/jquery.validate.min.js

104.17.25.14

200 OK

6.6 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/jquery.validate.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (22932)
Size
6.6 kB (6638 bytes)
Hash
9346ec27896981bc4c0b146cf327727a
21486194baa22eb1155fe98bf7af6314e7773cc7
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898

HTTP Headers

GET /ajax/libs/jquery-validate/1.16.0/jquery.validate.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 13:21:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 6638
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec2-5a1e"
last-modified: Mon, 04 May 2020 16:11:46 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1263367
expires: Tue, 15 Apr 2025 13:21:28 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XGrnTKJFt0V42%2FPbgRmiTugdo2q8TUj%2B%2F%2BVNgsUugBH6CoeeCwPqs7GLziR%2F3X9639UpoVFYQv8AAv0lWtVclIlbC56%2F%2FEccyCz0CdBT7G5arkOOFuoMZQPKmJgRK4GG%2BZyi4MGe"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 879ea2ea6fdb712f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/qrl-ver-A4288F3F0CE7F5C60C76A005C363B0A2.svg

45.55.112.74

200 OK

2.0 kB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/qrl-ver-A4288F3F0CE7F5C60C76A005C363B0A2.svg
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
SVG Scalable Vector Graphics image
Size
2.0 kB (2015 bytes)
Hash
a4288f3f0ce7f5c60c76a005c363b0a2
040c96d03849b32161c2f5a75570e300e101015b
9d0ce0dd87e2d9bc4171914be7b288f8388ce7c26dc58e0a465a82760e899914

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/qrl-ver-A4288F3F0CE7F5C60C76A005C363B0A2.svg HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:00 GMT
content-type: image/svg+xml
content-length: 2015
last-modified: Tue, 02 Aug 2022 02:53:44 GMT
etag: "7df-5e539397dde00"
accept-ranges: bytes
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/qrlhint-ver-916FDE8A4CA8095FC339D6829D7D6723.png

45.55.112.74

200 OK

45 kB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/qrlhint-ver-916FDE8A4CA8095FC339D6829D7D6723.png
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
PNG image data, 400 x 328, 8-bit/color RGBA, non-interlaced
Size
45 kB (44838 bytes)
Hash
916fde8a4ca8095fc339d6829d7d6723
361d7a7c72709eb08ac9b8fc97b99f54cd3d5378
fb6ebe23316c03fd8d25e871bfdd9c41eb77e14115f5a01e3e0d97b94617779e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/qrlhint-ver-916FDE8A4CA8095FC339D6829D7D6723.png HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:00 GMT
content-type: image/png
content-length: 44838
last-modified: Tue, 02 Aug 2022 02:53:46 GMT
etag: "af26-5e539399c6280"
accept-ranges: bytes
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/ING_Deutschland_NoClaim.svg

45.55.112.74

200 OK

16 kB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/ING_Deutschland_NoClaim.svg
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
SVG Scalable Vector Graphics image
Size
16 kB (16157 bytes)
Hash
3fadbc12d733ab01b8a1ef432d57201e
e3b63b70496e1132993e3195b98cce517eb6be7a
9a214e9df938fbc09d96e47ae4dbe031d7a581647a87c38ec371bc2a2d4dc7cf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/ING_Deutschland_NoClaim.svg HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/bundle.css
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:00 GMT
content-type: image/svg+xml
content-length: 16157
last-modified: Tue, 02 Aug 2022 02:51:00 GMT
etag: "3f1d-5e5392fb76d00"
accept-ranges: bytes
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/INGMeWeb-Regular.woff2

45.55.112.74

200 OK

30 kB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/INGMeWeb-Regular.woff2
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
Web Open Font Format (Version 2), TrueType, length 29616, version 1.0
Size
30 kB (29616 bytes)
Hash
97205b19383b6a85ef38eb0997c23c35
f7e0af7cfde57e454dde3a2a0c878cc37de5841e
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/INGMeWeb-Regular.woff2 HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/bundle.css
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:00 GMT
content-length: 29616
last-modified: Tue, 02 Aug 2022 03:02:10 GMT
etag: "73b0-5e53957a6d080"
accept-ranges: bytes
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/INGMeWeb-Bold.woff2

45.55.112.74

200 OK

30 kB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/INGMeWeb-Bold.woff2
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
Web Open Font Format (Version 2), TrueType, length 30456, version 1.0
Size
30 kB (30456 bytes)
Hash
126c1fdeee5cc17fef5f5909ebb5c86f
e2676a4a0c0f88ad2f33fe8acefc038073785de3
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/INGMeWeb-Bold.woff2 HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/bundle.css
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:01 GMT
content-length: 30456
last-modified: Tue, 02 Aug 2022 03:02:34 GMT
etag: "76f8-5e53959150680"
accept-ranges: bytes
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/webfonts/icons.woff

45.55.112.74

200 OK

32 kB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/webfonts/icons.woff
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
Web Open Font Format, TrueType, length 32296, version 1.0
Size
32 kB (32296 bytes)
Hash
1bdf5c66ba7e5eb7f5edfb45d2793603
83acd8228411d3872e0f1bfa1d0372684ddff6c8
305948d72ce8577a386f77079dacdb6841f18668f64cc7865a196a0624e5b5a8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/webfonts/icons.woff HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/bundle.css
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:01 GMT
content-type: application/font-woff
content-length: 32296
last-modified: Tue, 02 Aug 2022 02:50:56 GMT
etag: "7e28-5e5392f7a6400"
accept-ranges: bytes
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/icon.png

45.55.112.74

200 OK

1.9 kB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/icon.png
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.9 kB (1877 bytes)
Hash
34f56df9647fc5ef3bbefa31470b5827
16fd7a463e24ed60616286a68bc2102af0134ac0
1f188ffd3aa59bd0c27f1aaed73783064c52b8327809f8b1eb9c3454d51c46a9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/icon.png HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:01 GMT
content-type: image/png
content-length: 1877
last-modified: Tue, 02 Aug 2022 02:47:46 GMT
etag: "755-5e53924273880"
accept-ranges: bytes
X-Firefox-Spdy: h2

mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/bundle.css

45.55.112.74

200 OK

1.1 MB

URL GET HTTP/2
mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/css/bundle.css
IP
45.55.112.74:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerLet's Encrypt
Subjectcodeanyapp.com
FingerprintDF:F1:05:0B:4D:01:A4:04:2E:1F:4B:2B:BE:14:39:08:2D:AA:4C:AD
ValidityFri, 19 Apr 2024 07:22:36 GMT - Thu, 18 Jul 2024 07:22:35 GMT

File type

Size
1.1 MB (1100344 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - ING Group

HTTP Headers

GET /ing/access/delogin/css/bundle.css HTTP/1.1
Host: mail-kundeservice-itsmezak9486503.codeanyapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Cookie: PHPSESSID=c9qutitckpru7s81v7e6q1ugml
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Thu, 25 Apr 2024 12:38:00 GMT
content-type: text/css
last-modified: Tue, 02 Aug 2022 03:08:26 GMT
etag: "10ca38-5e5396e101e80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

104.18.11.207

200 OK

49 kB

URL GET HTTP/2
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
IP
104.18.11.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://mail-kundeservice-itsmezak9486503.codeanyapp.com/ing/access/delogin/login.php
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63
ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT

File type
JavaScript source, ASCII text, with very long lines (48664)
Size
49 kB (48944 bytes)
Hash
14d449eb8876fa55e1ef3c2cc52b0c17
a9545831803b1359cfeed47e3b4d6bae68e40e99
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

HTTP Headers

GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mail-kundeservice-itsmezak9486503.codeanyapp.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 13:21:28 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: US
cdn-edgestorageid: 617, 617, 617
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 2021-06-08 14:29:21
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: 395e10f82368220a7b7579d8f1c28956
cdn-cache: HIT
cf-cache-status: HIT
age: 13425621
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 879ea2ea7af056b1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (12)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size