Ing phishing and impersonation - 2 domains observed
MalwareAnalyzer by Cyble has observed 2 distinct domains impersonating Ing across 2 URL scans. 2 of them carry a malicious or suspicious verdict. None of these domains belong to Ing; they are sites impersonating it, detected by comparing a page's claimed identity against evidence of who actually operates it.
Lookalike domains impersonating Ing
The domain itself is the deception on these: a homograph, typosquat or a Ing brand token built into the name, on infrastructure Ing does not operate.
| Domain | Worst verdict | Evidence | Scans | First seen | Last seen | Kit |
|---|---|---|---|---|---|---|
| mcdonaldauto.ning.com | malicious | typosquat | 1 | 2026-08-24 | 2026-08-24 | |
| texas101jams.ning.com | malicious | typosquat | 1 | 2026-08-24 | 2026-08-24 |
Malware observed hosted on or communicating with these domains
None yet. That is the honest state, not a gap in the page: credential-harvesting phishing mostly collects logins rather than serving executables, so a domain can be actively hostile with no malware ever hosted on it. This section fills in only when a sample's runtime traffic, extracted configuration or download provenance evidences one of these domains - a hostname merely appearing inside a file's bytes is listed separately below and never counted here.
Samples containing one of these hostnames as a string
These samples merely CONTAIN one of the impersonating hostnames somewhere in their bytes - an embedded blocklist, a configuration template or a bundled report produces the same observation - so this is NOT evidence the sample ever contacted the domain, and it is never counted as an attack on Ing.
- 4488d696d93b47dd… - contains mcdonaldauto.ning.com
- 4488d696d93b47dd… - contains texas101jams.ning.com
How impersonation is detected
A page's CLAIMED identity (its title, og:site_name, favicon and phishing-kit
fingerprint) is compared against evidence of who actually operates it: the certificate subject
organisation, the RDAP registrant and the announcing network. A free domain-validated certificate
asserts nothing about ownership, and that asymmetry is itself the signal. A page on Ing's
own apex with a matching certificate organisation is treated as the real property, not an
impersonation, which is why this list does not include Ing's own sites.
These are point-in-time observations. A domain listed here may since have been taken down, and absence from this list is not evidence a domain is safe.
Questions about Ing phishing
- How many domains are impersonating Ing?
- 2 distinct domains, seen across 2 public URL scans, of which 2 currently carry a malicious or suspicious verdict.
- How can I tell a fake Ing site from the real one?
- Compare what the page CLAIMS against who demonstrably operates it: the certificate subject organisation, the domain's registrant and the network announcing its address. A free domain-validated certificate proves control of the name and nothing about ownership, and that asymmetry is the signal - a real Ing property does not need to borrow the brand's look.
- Is a domain safe if it is not listed here?
- No. This lists what MalwareAnalyzer has scanned, not the whole internet, and a domain taken down yesterday still appears. Absence is not evidence of safety - scan the specific URL.
All brands under attack · Scan a URL · Latest analyzed threats · How URL scanning works