belastingachterstand.nl Open in urlscan Pro
5.75.131.212 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://belastingachterstand.nl/belasting/
Submission: On July 28 via manual (July 28th 2024, 11:11:50 am UTC) from PT — Scanned from NL

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 5.75.131.212, located in Germany and belongs to HETZNER-AS, DE. The main domain is belastingachterstand.nl.
TLS certificate: Issued by E5 on July 27th 2024. Valid for: 3 months.

This is the only time belastingachterstand.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NL Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 10	5.75.131.212 5.75.131.212	24940 (HETZNER-AS) (HETZNER-AS)
2	18.193.126.142 18.193.126.142	16509 (AMAZON-02) (AMAZON-02)
1	3.5.135.159 3.5.135.159	16509 (AMAZON-02) (AMAZON-02)
12	4

10 5.75.131.212 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: brcd.host

belastingachterstand.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.193.126.142 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-126-142.eu-central-1.compute.amazonaws.com

cdn.pulse.is	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.5.135.159 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: s3.eu-central-1.amazonaws.com

s3.eu-central-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	belastingachterstand.nl 1 redirects belastingachterstand.nl	350 KB
2	pulse.is cdn.pulse.is — Cisco Umbrella Rank: 809032	79 KB
1	amazonaws.com s3.eu-central-1.amazonaws.com	1 KB
12	3

	Domain	Requested by
10	belastingachterstand.nl	1 redirects belastingachterstand.nl
2	cdn.pulse.is	belastingachterstand.nl cdn.pulse.is
1	s3.eu-central-1.amazonaws.com	cdn.pulse.is
12	3

This site contains no links.

Subject Issuer	Validity	Valid
belastingachterstand.nl E5	`2024-07-27` - `2024-10-25`	3 months	crt.sh
*.pulse.is Sectigo RSA Domain Validation Secure Server CA	`2024-02-10` - `2025-02-13`	a year	crt.sh
*.s3.eu-central-1.amazonaws.com Amazon RSA 2048 M01	`2024-02-08` - `2025-01-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://belastingachterstand.nl/belasting/
Frame ID: 10D54828E603C8CBFB7B8BDB5B3DBFC3
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Belastingdienst Nederland

Page URL History Show full URLs

https://belastingachterstand.nl/belasting HTTP 301
https://belastingachterstand.nl/belasting/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

475 kB
Transfer

1855 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://belastingachterstand.nl/belasting HTTP 301
https://belastingachterstand.nl/belasting/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response belastingachterstand.nl/belasting/ Redirect Chain https://belastingachterstand.nl/belasting https://belastingachterstand.nl/belasting/	10 KB 3 KB	26ms 26ms	Document text/html	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://belastingachterstand.nl/belasting/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `c9fef2cf3343d9cfd7f4aeba4da12c9d9c312e94955fd4c63e3f0edf0ef31df7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 2688 content-type text/html date Sun, 28 Jul 2024 11:11:45 GMT etag "2824-66a4e7a1-9db50;br" last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding gzip content-type text/html date Sun, 28 Jul 2024 11:11:45 GMT location https://belastingachterstand.nl/belasting/ server LiteSpeed vary Accept-Encoding
GET H3	200	bootstrap.min.css belastingachterstand.nl/belasting/assets/	190 KB 24 KB	26ms 25ms	Stylesheet text/css	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://belastingachterstand.nl/belasting/assets/bootstrap.min.css Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `a0893072c10d5f00bc8b8731215b7f641e461cabaa6c4ade0b5b581f805bd03c` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:45 GMT content-encoding br last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "2f977-66a4e7a1-9db48;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 23997 expires Sun, 04 Aug 2024 11:11:45 GMT
GET H3	200	fonts.css belastingachterstand.nl/belasting/assets/	1 MB 213 KB	30ms 29ms	Stylesheet text/css	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://belastingachterstand.nl/belasting/assets/fonts.css Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `8f78ad5da207cb591669db9a5497f9f01dcae196b3caec26bf77fc857b727bbf` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:45 GMT content-encoding br last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "11d577-66a4e7a1-9db45;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 218405 expires Sun, 04 Aug 2024 11:11:45 GMT
GET H3	200	style.css belastingachterstand.nl/belasting/assets/	51 KB 7 KB	545ms 543ms	Stylesheet text/css	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://belastingachterstand.nl/belasting/assets/style.css Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `ac299d85c8618f6b13a05095b4785ba5c65dcc51f898d4cb6f5bb761349678e1` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:45 GMT content-encoding br last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "cab9-66a4e7a1-9db4e;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 7268 expires Sun, 04 Aug 2024 11:11:45 GMT
GET H3	200	jquery-3.7.1.min.js Show response belastingachterstand.nl/belasting/assets/	85 KB 29 KB	129ms 128ms	Script text/javascript	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://belastingachterstand.nl/belasting/assets/jquery-3.7.1.min.js Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:45 GMT content-encoding br last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "155ed-66a4e7a1-9db47;br" vary Accept-Encoding content-type text/javascript accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 29595
GET H3	200	bootstrap.min.js Show response belastingachterstand.nl/belasting/assets/	59 KB 15 KB	550ms 550ms	Script text/javascript	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://belastingachterstand.nl/belasting/assets/bootstrap.min.js Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:45 GMT content-encoding br last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "ebf4-66a4e7a1-9db4f;br" vary Accept-Encoding content-type text/javascript accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 15472
GET H3	200	lg00b2.png belastingachterstand.nl/belasting/assets/img/	53 KB 53 KB	564ms 563ms	Image image/png	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://belastingachterstand.nl/belasting/assets/img/lg00b2.png Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `0149f7a894e28f6971802b0f74b0254337ce6176709d8113baacc0f691f8e69a` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:45 GMT last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "d538-66a4e7a1-9db4c;;;" content-type image/png cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 54584 expires Sun, 04 Aug 2024 11:11:45 GMT
GET H3	200	chat-icon2.png belastingachterstand.nl/belasting/assets/img/	3 KB 3 KB	564ms 563ms	Image image/png	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://belastingachterstand.nl/belasting/assets/img/chat-icon2.png Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `510b834625346a3f29ad64c823c65f96dba9b7bc8b5daa2a27bc9873736b0226` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:45 GMT last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "ad7-66a4e7a1-9db4a;;;" content-type image/png cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 2775 expires Sun, 04 Aug 2024 11:11:45 GMT
GET H/1.1	200 OK	loader.js Show response cdn.pulse.is/livechat/	3 KB 2 KB	121ms 46ms	Script text/javascript	18.193.126.142 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.pulse.is/livechat/loader.js Requested by Host: belastingachterstand.nl URL: https://belastingachterstand.nl/belasting/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 18.193.126.142 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-193-126-142.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `64cfbdfebaf09f896d03efbc10bebb91c2a456af926f77f389de104dc8794136` Request headers Referer https://belastingachterstand.nl/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Sun, 28 Jul 2024 11:11:46 GMT Content-Encoding gzip Last-Modified Thu, 25 Jul 2024 10:55:49 GMT Server nginx x-amz-request-id 0RHFZHEYXYRZBN32 ETag W/"14d34f022ee2e68afd39ed2c627d7562" x-amz-server-side-encryption AES256 Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive x-amz-id-2 tv/a8HiI7tJcQeW1kAD9yE34W02Uu2EymiP1t2TxeG2c9qhroeTqlKsClEfrQXxNTbFwdZ37OAw=
GET DATA	200 OK	truncated /	231 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0c423574c169bcda1bac06d877eb1d94e018b4f2f54c637eb632cd00ebc5d6f5` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	46 KB 46 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42` Request headers Referer Origin https://belastingachterstand.nl User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
GET H/1.1	200 OK	bundle.js Show response cdn.pulse.is/livechat/	211 KB 78 KB	75ms 74ms	Script text/javascript	18.193.126.142 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.pulse.is/livechat/bundle.js Requested by Host: cdn.pulse.is URL: https://cdn.pulse.is/livechat/loader.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 18.193.126.142 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-193-126-142.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `f5b7c1190d30f5c98d3024a34e8f14d16b469e3611cabe358173d78a6b2809ba` Request headers Referer https://belastingachterstand.nl/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Sun, 28 Jul 2024 11:11:46 GMT Content-Encoding gzip Last-Modified Thu, 25 Jul 2024 10:55:47 GMT Server nginx x-amz-request-id 0RHBHKT7G2YAYPCF ETag W/"ddbcf1032014da6d05bf08ebb53c7955" x-amz-server-side-encryption AES256 Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive x-amz-id-2 DDz3zQxUamQ5TXLx+zUmi3+iIGxk7zTFLC6AtDUa3X/YqwBPSxELSnp4wMa30ZAcw2fm4qJ6SiewVRkERcYjCA==
GET H/1.1	200 OK	669d0ddc807c887ca6009f4b.json Show response s3.eu-central-1.amazonaws.com/live-chat.sendpulse.prod/bots/	646 B 1 KB	120ms 46ms	Fetch application/json	3.5.135.159 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.eu-central-1.amazonaws.com/live-chat.sendpulse.prod/bots/669d0ddc807c887ca6009f4b.json Requested by Host: cdn.pulse.is URL: https://cdn.pulse.is/livechat/bundle.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.5.135.159 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `8e9f1a56bcd0c7188e5ac2b2861fbe84d01694c9bba9ba7bd5ab954e4f6734c3` Request headers Referer https://belastingachterstand.nl/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Sun, 28 Jul 2024 11:11:47 GMT Last-Modified Sun, 28 Jul 2024 10:23:12 GMT Server AmazonS3 x-amz-request-id 0RH6TEY9RB7P67ND ETag "8775f4a2f80723a28f6041a24a066c0b" x-amz-server-side-encryption AES256 Access-Control-Max-Age 3000 Vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method Access-Control-Allow-Methods GET, HEAD Access-Control-Allow-Origin * Content-Type application/json Accept-Ranges bytes Content-Length 646 x-amz-id-2 Wc8VIiTutCL9gnZlvAIjW38DQxSR6oI0YEIc7sUdgKh+Gol2D7Bg3hFM8HRBTBmKp2UgNgOgrDkq3ASfFJl6bg==
GET H3	200	favicon.ico belastingachterstand.nl/belasting/assets/img/	2 KB 1 KB	30ms 29ms	Other image/x-icon	5.75.131.212 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://belastingachterstand.nl/belasting/assets/img/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 5.75.131.212 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS brcd.host Software LiteSpeed / Resource Hash `bf0122567c08c9b8201194a22321f37a89a0e81a1644939a7cf19d3d40e87983` Request headers Referer https://belastingachterstand.nl/belasting/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Sun, 28 Jul 2024 11:11:46 GMT content-encoding br last-modified Sat, 27 Jul 2024 12:27:13 GMT server LiteSpeed etag "710-66a4e7a1-9db4b;br" vary Accept-Encoding content-type image/x-icon cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1412 expires Sun, 04 Aug 2024 11:11:46 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NL Government (Government)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.belastingachterstand.nl/	1970-01-21 02:41:57	Name: sbjs_migrations Value: 1418474375998%3D1
.belastingachterstand.nl/	1970-01-21 02:41:57	Name: sbjs_current_add Value: fd%3D2024-07-28%2013%3A11%3A46%7C%7C%7Cep%3Dhttps%3A%2F%2Fbelastingachterstand.nl%2Fbelasting%2F%7C%7C%7Crf%3D%28none%29
.belastingachterstand.nl/	1970-01-21 02:41:57	Name: sbjs_first_add Value: fd%3D2024-07-28%2013%3A11%3A46%7C%7C%7Cep%3Dhttps%3A%2F%2Fbelastingachterstand.nl%2Fbelasting%2F%7C%7C%7Crf%3D%28none%29
.belastingachterstand.nl/	1970-01-21 02:41:57	Name: sbjs_current Value: typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29
.belastingachterstand.nl/	1970-01-21 02:41:57	Name: sbjs_first Value: typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29
.belastingachterstand.nl/	1970-01-21 02:41:57	Name: sbjs_udata Value: vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F126.0.0.0%20Safari%2F537.36
.belastingachterstand.nl/	1970-01-20 22:22:45	Name: sbjs_session Value: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fbelastingachterstand.nl%2Fbelasting%2F

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

belastingachterstand.nl
cdn.pulse.is
s3.eu-central-1.amazonaws.com
18.193.126.142
3.5.135.159
5.75.131.212
0149f7a894e28f6971802b0f74b0254337ce6176709d8113baacc0f691f8e69a
0c423574c169bcda1bac06d877eb1d94e018b4f2f54c637eb632cd00ebc5d6f5
510b834625346a3f29ad64c823c65f96dba9b7bc8b5daa2a27bc9873736b0226
64cfbdfebaf09f896d03efbc10bebb91c2a456af926f77f389de104dc8794136
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
8e9f1a56bcd0c7188e5ac2b2861fbe84d01694c9bba9ba7bd5ab954e4f6734c3
8f78ad5da207cb591669db9a5497f9f01dcae196b3caec26bf77fc857b727bbf
9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0
a0893072c10d5f00bc8b8731215b7f641e461cabaa6c4ade0b5b581f805bd03c
ac299d85c8618f6b13a05095b4785ba5c65dcc51f898d4cb6f5bb761349678e1
bf0122567c08c9b8201194a22321f37a89a0e81a1644939a7cf19d3d40e87983
c9fef2cf3343d9cfd7f4aeba4da12c9d9c312e94955fd4c63e3f0edf0ef31df7
f5b7c1190d30f5c98d3024a34e8f14d16b469e3611cabe358173d78a6b2809ba
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

belastingachterstand.nl Open in urlscan Pro 5.75.131.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

475 kBTransfer

1855 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

7 Cookies

Indicators

belastingachterstand.nl Open in urlscan Pro
5.75.131.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

475 kB
Transfer

1855 kB
Size

7
Cookies

12 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!