urlscan.io logo urlscan.io
SecurityTrails logo

direct-betalen.com Open in urlscan Pro
89.248.168.204  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://direct-betalen.com/belastingdienst/BD7893409/
Submission Tags: @ecarlesi threat #phishing #belastingdienst Search All
Submission: On November 07 via api from AU — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 89.248.168.204, located in Amsterdam, Netherlands and belongs to INT-NETWORK, SC. The main domain is direct-betalen.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 6th 2023. Valid for: 3 months.
This is the only time direct-betalen.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NL Government (Government)

Domain & IP information

IP Address AS Autonomous System
2 89.248.168.204 202425 (INT-NETWORK)
1 2a04:9a01:100... 34663 (ASBELASTI...)
3 3
Apex Domain
Subdomains		 Transfer
2 direct-betalen.com
direct-betalen.com
3 MB
1 belastingdienst.nl
www.belastingdienst.nl — Cisco Umbrella Rank: 242546
20 KB
3 2
Domain Requested by
2 direct-betalen.com direct-betalen.com
1 www.belastingdienst.nl direct-betalen.com
3 2

This site contains links to these domains. Also see Links.

Domain
www.cjib.nl
www.facebook.com
twitter.com
www.linkedin.com
api.whatsapp.com
Subject Issuer Validity Valid
direct-betalen.com
cPanel, Inc. Certification Authority		 2023-11-06 -
2024-02-04		 3 months crt.sh
www.belastingdienst.nl
QuoVadis Europe SSL CA G2		 2023-05-22 -
2024-05-22		 a year crt.sh

This page contains 1 frames:

Primary Page: https://direct-betalen.com/belastingdienst/BD7893409/
Frame ID: 2788E85314F6C4A9B3090EC79494C811
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Belastingdienst Nederland | Page 1 Page 1 Group 8 Group 6 Group 11 Group 10 Group 21 Group 6 Group 12 Group 19 Group 13 Group 18 Page 1 Group 15 Group 14 Group 16

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

3259 kB
Transfer

3295 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
direct-betalen.com/belastingdienst/BD7893409/ 		3 MB
3 MB 		Document
General
Check archive.org
Download Go to
Full URL
https://direct-betalen.com/belastingdienst/BD7893409/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
89.248.168.204 Amsterdam, Netherlands, ASN202425 (INT-NETWORK, SC),
Reverse DNS
ns110.underhost.com
Software
Apache /
Resource Hash
d70026eeccd13e47d1f904fd55acf09861ec8274dd8e235d52c50a45a10ee7f5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
3034864
Content-Type
text/html
Date
Tue, 07 Nov 2023 09:14:29 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Mon, 06 Nov 2023 13:53:04 GMT
Server
Apache
bld_logo.svg
www.belastingdienst.nl/bld-assets/bld/rhslogos/ 		17 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.belastingdienst.nl/bld-assets/bld/rhslogos/bld_logo.svg
Requested by
Host: direct-betalen.com
URL: https://direct-betalen.com/belastingdienst/BD7893409/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a04:9a01:1002::33 , Netherlands, ASN34663 (ASBELASTINGDIENST, NL),
Reverse DNS
Software
/
Resource Hash
24c2c8d65ef0423159d5505ed54492d1346611b076c14fd3af08e5364ce83d9e
Security Headers
Name Value
Content-Security-Policy default-src https://*.belastingdienst.nl https://vinden.belastingdienst.nl https://*.readspeaker.com; connect-src 'self' https://*.belastingdienst.nl https://*.optimizely.com https://*.readspeaker.com https://*.abtasty.com https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com https://*.2o7.net https://api.pdok.nl; child-src 'self' https://belastingdienst.nl https://*.belastingdienst.nl https://*.cdn.optimizely.com https://secure.opinionlab.com https://*.readspeaker.com https://www.anbi-instellingen.nl https://www.youtube.com https://www.youtube-nocookie.com https://cm.everesttech.net; frame-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com https://secure.opinionlab.com https://www.youtube.com https://www.youtube-nocookie.com https://*.demdex.net ; frame-ancestors 'self' https://*.belastingdienst.nl https://*.pagefreezer.com https://*.pagefreezer.nl ; img-src 'self' https://n01d05.cumulus-cloud.com https://*.readspeaker.com https://img.youtube.com https://*.demdex.net https://cm.everesttech.net *.2o7.net data: https://*.belastingdienst.nl blob: data: *.abtasty.com; font-src 'self' https://*.belastingdienst.nl blob: data: *.abtasty.com; script-src 'self' https://*.belastingdienst.nl https://cdn.optimizely.com https://*.readspeaker.com https://bdtm.containers.piwik.pro https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com 'unsafe-eval' 'unsafe-inline' blob: *.abtasty.com ; style-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com *.abtasty.com 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://direct-betalen.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date
Tue, 07 Nov 2023 09:14:30 GMT
Content-Security-Policy
default-src https://*.belastingdienst.nl https://vinden.belastingdienst.nl https://*.readspeaker.com; connect-src 'self' https://*.belastingdienst.nl https://*.optimizely.com https://*.readspeaker.com https://*.abtasty.com https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com https://*.2o7.net https://api.pdok.nl; child-src 'self' https://belastingdienst.nl https://*.belastingdienst.nl https://*.cdn.optimizely.com https://secure.opinionlab.com https://*.readspeaker.com https://www.anbi-instellingen.nl https://www.youtube.com https://www.youtube-nocookie.com https://cm.everesttech.net; frame-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com https://secure.opinionlab.com https://www.youtube.com https://www.youtube-nocookie.com https://*.demdex.net ; frame-ancestors 'self' https://*.belastingdienst.nl https://*.pagefreezer.com https://*.pagefreezer.nl ; img-src 'self' https://n01d05.cumulus-cloud.com https://*.readspeaker.com https://img.youtube.com https://*.demdex.net https://cm.everesttech.net *.2o7.net data: https://*.belastingdienst.nl blob: data: *.abtasty.com; font-src 'self' https://*.belastingdienst.nl blob: data: *.abtasty.com; script-src 'self' https://*.belastingdienst.nl https://cdn.optimizely.com https://*.readspeaker.com https://bdtm.containers.piwik.pro https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com 'unsafe-eval' 'unsafe-inline' blob: *.abtasty.com ; style-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com *.abtasty.com 'unsafe-inline'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000
Last-Modified
Mon, 21 Aug 2023 07:08:12 GMT
ETag
"454b-603698a9b53a0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=21
Content-Length
17739
X-XSS-Protection
1; mode=block;
truncated
/ 		325 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8e1259c7006dfe0d19f6bcc4fc622c4ce555250e9924fa20cafbe137e64d72eb

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a

Request headers

Referer
Origin
https://direct-betalen.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		68 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591

Request headers

Referer
Origin
https://direct-betalen.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		82 KB
82 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95b8c28ae6c0c9d5657a44d5a6ca24c04165eef39d6a8e1e93627c8d755ffe3a

Request headers

Referer
Origin
https://direct-betalen.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		29 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4ec0583dd05c9ae23e4f612829312af92f4b38961c0b1fbf53a266f20d4eb182

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/jpeg
ideal-logo-1024.png
direct-betalen.com/www.ideal.nl/img/logo/ 		51 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://direct-betalen.com/www.ideal.nl/img/logo/ideal-logo-1024.png
Requested by
Host: direct-betalen.com
URL: https://direct-betalen.com/belastingdienst/BD7893409/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
89.248.168.204 Amsterdam, Netherlands, ASN202425 (INT-NETWORK, SC),
Reverse DNS
ns110.underhost.com
Software
Apache /
Resource Hash
8c48b81b373e6dac8c9c39072db0ab401be309a8a2a4e2f032cb5d5f2017ae4c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://direct-betalen.com/belastingdienst/BD7893409/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date
Tue, 07 Nov 2023 09:14:30 GMT
Last-Modified
Thu, 31 Aug 2023 13:59:26 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
51733
truncated
/ 		673 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c922548cfe09320db090d544611419072db72918c07a3588e8138bd474eb41d3

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		847 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ea24041f1bf773952f69e1e98082de62b89f24ca6b60b147f2f052b21e3b6861

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		686 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f325b8b3a6c772d7ebef4dea572c8da501e9c6ee286df0d96dfa49441258fd2f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
85f028fadd26412f3ff050e58fab1c791a172e44f078db492c89bbb950053695

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dc4b94fbd1ec10e1ed4e130d8c785c2f0f7a6dacee88c019d3d77782b86d43ba

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dc9b62c0c22ee9ed9efc6b63664e860df4979d42279d6d76d5720beec4c8b239

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76cba8c616494b98ce3232bb080e8beef3583aa75368c65b5e121508f92bb6a4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NL Government (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| savepage_ShadowLoader

0 Cookies