belastingschuld.com
Open in
urlscan Pro
94.156.67.151
Malicious Activity!
Public Scan
URL:
https://belastingschuld.com/belasting/
Submission: On June 28 via api from US — Scanned from DE
Submission: On June 28 via api from US — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 12 HTTP transactions.
The main IP is 94.156.67.151, located in
Bulgaria and
belongs to LIMENET, US.
The main domain is belastingschuld.com.
TLS certificate: Issued by E5 on June 28th 2024. Valid for: 3 months.
This is the only time belastingschuld.com was scanned on urlscan.io!
TLS certificate: Issued by E5 on June 28th 2024. Valid for: 3 months.
This is the only time belastingschuld.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NL Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 94.156.67.151 94.156.67.151 | 394711 (LIMENET) (LIMENET) | |
| 2 | 18.193.126.142 18.193.126.142 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 52.219.169.21 52.219.169.21 | 16509 (AMAZON-02) (AMAZON-02) | |
| 12 | 4 |
2
18.193.126.142
(Frankfurt am Main, Germany)
ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-126-142.eu-central-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-126-142.eu-central-1.compute.amazonaws.com
| cdn.pulse.is |
1
52.219.169.21
(Frankfurt am Main, Germany)
ASN16509 (AMAZON-02, US)
PTR: s3.eu-central-1.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: s3.eu-central-1.amazonaws.com
| s3.eu-central-1.amazonaws.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
belastingschuld.com
belastingschuld.com |
1004 KB |
| 2 |
pulse.is
cdn.pulse.is — Cisco Umbrella Rank: 886292 |
79 KB |
| 1 |
amazonaws.com
s3.eu-central-1.amazonaws.com |
1004 B |
| 12 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | belastingschuld.com |
belastingschuld.com
|
| 2 | cdn.pulse.is |
belastingschuld.com
cdn.pulse.is |
| 1 | s3.eu-central-1.amazonaws.com |
cdn.pulse.is
|
| 12 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| belastingschuld.com E5 |
2024-06-28 - 2024-09-26 |
3 months | crt.sh |
| *.pulse.is Sectigo RSA Domain Validation Secure Server CA |
2024-02-10 - 2025-02-13 |
a year | crt.sh |
| *.s3.eu-central-1.amazonaws.com Amazon RSA 2048 M01 |
2024-02-08 - 2025-01-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://belastingschuld.com/belasting/
Frame ID: 2C288AA7EFA9B882817378E7AE245D21
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Belastingdienst NederlandDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
belastingschuld.com/belasting/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
belastingschuld.com/belasting/assets/ |
190 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fonts.css
belastingschuld.com/belasting/assets/ |
1 MB 861 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
belastingschuld.com/belasting/assets/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.7.1.min.js
belastingschuld.com/belasting/assets/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
belastingschuld.com/belasting/assets/ |
59 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lg00b2.png
belastingschuld.com/belasting/assets/img/ |
53 KB 54 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
chat-icon2.png
belastingschuld.com/belasting/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loader.js
cdn.pulse.is/livechat/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bundle.js
cdn.pulse.is/livechat/ |
211 KB 78 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
231 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
6678075de804b6d292079b77.json
s3.eu-central-1.amazonaws.com/live-chat.sendpulse.prod/bots/ |
423 B 1004 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
belastingschuld.com/belasting/assets/img/ |
2 KB 2 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NL Government (Government)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery number| uidEvent object| bootstrap function| scroll2block function| _typeof function| ownKeys function| _objectSpread function| _defineProperty function| _toPropertyKey function| _toPrimitive object| spLiveChatLoadedEvent function| createScriptElement function| insert function| getHost object| sp function| HowlerGlobal object| Howler function| Howl function| Sound7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .belastingschuld.com/ | Name: sbjs_migrations Value: 1418474375998%3D1 |
|
| .belastingschuld.com/ | Name: sbjs_current_add Value: fd%3D2024-06-28%2015%3A04%3A30%7C%7C%7Cep%3Dhttps%3A%2F%2Fbelastingschuld.com%2Fbelasting%2F%7C%7C%7Crf%3D%28none%29 |
|
| .belastingschuld.com/ | Name: sbjs_first_add Value: fd%3D2024-06-28%2015%3A04%3A30%7C%7C%7Cep%3Dhttps%3A%2F%2Fbelastingschuld.com%2Fbelasting%2F%7C%7C%7Crf%3D%28none%29 |
|
| .belastingschuld.com/ | Name: sbjs_current Value: typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29 |
|
| .belastingschuld.com/ | Name: sbjs_first Value: typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29 |
|
| .belastingschuld.com/ | Name: sbjs_udata Value: vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F126.0.0.0%20Safari%2F537.36 |
|
| .belastingschuld.com/ | Name: sbjs_session Value: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fbelastingschuld.com%2Fbelasting%2F |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
belastingschuld.com
cdn.pulse.is
s3.eu-central-1.amazonaws.com
18.193.126.142
52.219.169.21
94.156.67.151
0149f7a894e28f6971802b0f74b0254337ce6176709d8113baacc0f691f8e69a
0c423574c169bcda1bac06d877eb1d94e018b4f2f54c637eb632cd00ebc5d6f5
4393b845d8435ceffa374fc6d8ee38f4a2378d7f1e0025653d9ae796fcc1436e
510b834625346a3f29ad64c823c65f96dba9b7bc8b5daa2a27bc9873736b0226
64cfbdfebaf09f896d03efbc10bebb91c2a456af926f77f389de104dc8794136
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
8f78ad5da207cb591669db9a5497f9f01dcae196b3caec26bf77fc857b727bbf
9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0
a0893072c10d5f00bc8b8731215b7f641e461cabaa6c4ade0b5b581f805bd03c
ac299d85c8618f6b13a05095b4785ba5c65dcc51f898d4cb6f5bb761349678e1
bbd78e79c1087109ba028c5458ad22a85352f9a0f8e4f6905df38c6ddcc3fe32
bf0122567c08c9b8201194a22321f37a89a0e81a1644939a7cf19d3d40e87983
db016d9a146a1cd6183e75e2add9f2f6588227b0ad1f2c1817e460cad2093d68
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a