Phishing detection: ingdirect-clienteweb-login.com
ING España Investigate
Domain
ingdirect-clienteweb-login.com1 CT host on apex
IP
188.114.97.3
URL
https://ingdirect-clienteweb-login.com
Cert
YE2
Phishunt analysis Beta
32
medium suspicion suspiciousheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +5.1 Site cluster
- +3.4 Shared IP cluster
- +2.2 Country mismatch
- +1.6 Favicon (kit)
- +1.4 ASN reputation
- +1.4 Registrar reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.8 Young domain
- +0.6 Long domain
- +0.6 Final host mismatch
- +0.3 Free CA
- +0.2 Hyphens
- +0.2 Obfuscated JavaScript
- +0.2 Suspicious TLD
21 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Impersonates ING Spain's online banking with a lookalike login domain behind Cloudflare, likely harvesting customer credentials. The favicon matches a known phishing kit and the page redirects to a different final host; flagged by Google Safe Browsing.
Favicon (kit)Final host mismatchGoogle Safe Browsing
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-20 · confidence 85%
Domain & Network
Whois
Registrar
NICENIC INTERNATIONAL GROUP CO., LIMITED
Network
IP
188.114.97.3 Cloudflare CDN
Country
United States
Hosting
Cloudflare, Inc.
ASN
AS13335
TLS Cert
YE2
External detection
Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io · SANS ISC
Requests
Resources
Observables
Related websites
Report this phishing
Submit to blocklists
urlscan
VirusTotal
Whois
ipinfo
Greynoise