Phishing detection: ingdirect-portal-ingreso.com
ING España Screenshot
Investigate
Domain
ingdirect-portal-ingreso.com1 CT host on apex
urlscan
VirusTotal
Whois
IP
188.114.97.3
ipinfo
Greynoise
URL
https://ingdirect-portal-ingreso.com
Phishunt analysis Beta
33
medium suspicion suspiciousheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +5.1 Site cluster
- +3.4 Shared IP cluster
- +2.2 Country mismatch
- +2.0 ASN reputation
- +1.6 Favicon (kit)
- +1.4 Registrar reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 Young certificate
- +0.8 Young domain
- +0.6 Long domain
- +0.6 Final host mismatch
- +0.3 Free CA
- +0.2 Hyphens
- +0.2 Obfuscated JavaScript
- +0.2 Suspicious TLD
22 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Spanish-language domain posing as an ING Direct customer login portal. Fronted by Cloudflare and flagged by Google Safe Browsing for social engineering. The favicon matches a known phishing kit and the final host differs from the entry domain.
Favicon (kit)Google Safe BrowsingFinal host mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-24 · confidence 80%
Domain & Network
Whois
Registrar
NICENIC INTERNATIONAL GROUP CO., LIMITED
Network
IP
188.114.97.3 Cloudflare CDN
Country
United States
United States
Hosting
Cloudflare, Inc.
ASN
AS13335
TLS Cert
WE1
External detection
Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Submit to blocklists