Phishing detection: ingdirect-ingreso-usuarios.com

ING España
https://ingdirect-ingreso-usuarios.com Access site
Screenshot
Screenshot of ingdirect-ingreso-usuarios.com
Investigate
Domain ingdirect-ingreso-usuarios.com0 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 172.67.206.26
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://ingdirect-ingreso-usuarios.com
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
31 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +4.0 Young domain
  • +2.2 Country mismatch
  • +1.9 ASN reputation
  • +1.4 Registrar reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 No registrar lock
  • +0.6 Long domain
  • +0.6 Final host mismatch
  • +0.2 Hyphens
  • +0.2 Suspicious TLD
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Impersonates ING Direct Spain's user login portal to steal banking credentials. Registered only 3 days before detection, hosted in the US via Cloudflare, and flagged as social engineering by Google Safe Browsing. Part of a coordinated multi-domain phishing campaign.

Google Safe BrowsingYoung domainCountry mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-22 · confidence 87%
Domain & Network
Whois
Registrar NICENIC INTERNATIONAL GROUP CO., LIMITED
Network
IP 172.67.206.26
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert -
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Campaign
This detection belongs to possible campaign 0c1b79ab9b24 (8 members total)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
ingdirect-clientes-alerta.com 63 similar text same nameservers same redirect target similar name registered together same registrar appeared together (24h) same screenshot
active 2026-07-12
ingdirect-soporte-servicios.com 63 similar text same nameservers same redirect target similar name registered together same registrar appeared together (24h) same screenshot
active 2026-07-12
ingdirect-usuario-soporte.com 63 similar text same nameservers same redirect target similar name registered together same registrar appeared together (24h) same screenshot
active 2026-07-12
ingdirect-web-validado.com 63 similar text same nameservers same redirect target similar name registered together same registrar appeared together (24h) same screenshot
active 2026-07-12
ingdirect-alerta-clientes.com 46 similar text same redirect target similar name same registrar appeared together (24h) same screenshot
active 2026-07-12
Top 5 of 7 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-12 15:41 UTC  ·  Last refreshed 2026-08-31 03:30 UTC