urlscan.io logo urlscan.io
SecurityTrails logo

openstaandeschuld-afbetalen.online Open in urlscan Pro
45.146.255.21  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://schuld-betalen.online/
Effective URL: https://openstaandeschuld-afbetalen.online/belastingdienst/BD7895429/
Submission: On August 27 via manual from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 45.146.255.21, located in Germany and belongs to AUROLOGIC aurologic GmbH, DE. The main domain is openstaandeschuld-afbetalen.online.
TLS certificate: Issued by R3 on August 26th 2023. Valid for: 3 months.
This is the only time openstaandeschuld-afbetalen.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NL Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 5.249.164.115 30823 (AUROLOGIC...)
1 45.146.255.21 30823 (AUROLOGIC...)
1 2a04:9a01:100... 34663 (ASBELASTI...)
1 2a03:9700:800... 20847 (PREVIDER-AS)
4 5
Domain Requested by
1 www.ideal.nl openstaandeschuld-afbetalen.online
1 www.belastingdienst.nl openstaandeschuld-afbetalen.online
1 openstaandeschuld-afbetalen.online
1 schuld-betalen.online
4 4

This site contains links to these domains. Also see Links.

Domain
www.cjib.nl
www.facebook.com
twitter.com
www.linkedin.com
api.whatsapp.com
Subject Issuer Validity Valid
openstaandeschuld-afbetalen.online
R3		 2023-08-26 -
2023-11-24		 3 months crt.sh
www.belastingdienst.nl
QuoVadis Europe SSL CA G2		 2023-05-22 -
2024-05-22		 a year crt.sh
www.ideal.nl
Sectigo RSA Extended Validation Secure Server CA		 2023-03-02 -
2024-03-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://openstaandeschuld-afbetalen.online/belastingdienst/BD7895429/
Frame ID: 7DD716AE975BC210690CA3771EF5A008
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Een schuld afbetalen | Belastingdienst Page 1 Page 1 Group 8 Group 6 Group 11 Group 10 Group 21 Group 6 Group 12 Group 19 Group 13 Group 18 Page 1 Group 15 Group 14 Group 16

Page Statistics

4
Requests

75 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1211 kB
Transfer

3294 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
schuld-betalen.online/ 		0
290 B 		Document
General
Check archive.org
Download Go to
Full URL
http://schuld-betalen.online/
Protocol
HTTP/1.1
Server
5.249.164.115 Frankfurt am Main, Germany, ASN30823 (AUROLOGIC aurologic GmbH, DE),
Reverse DNS
vps-zap1124833-2.zap-srv.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Sun, 27 Aug 2023 16:25:07 GMT
Keep-Alive
timeout=5, max=100
Refresh
0; URL=https://openstaandeschuld-afbetalen.online/belastingdienst/BD7895429/
Server
Apache/2.4.29 (Ubuntu)
Primary Request /
openstaandeschuld-afbetalen.online/belastingdienst/BD7895429/ 		3 MB
916 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://openstaandeschuld-afbetalen.online/belastingdienst/BD7895429/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
45.146.255.21 , Germany, ASN30823 (AUROLOGIC aurologic GmbH, DE),
Reverse DNS
vps-zap1124833-1.zap-srv.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
feab125e06ec04c302c19a352349489ed08b004188f5e00fb8f024870d09c65d

Request headers

Referer
http://schuld-betalen.online/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sun, 27 Aug 2023 16:25:07 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.29 (Ubuntu)
Transfer-Encoding
chunked
Vary
Accept-Encoding
bld_logo.svg
www.belastingdienst.nl/bld-assets/bld/rhslogos/ 		17 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.belastingdienst.nl/bld-assets/bld/rhslogos/bld_logo.svg
Requested by
Host: openstaandeschuld-afbetalen.online
URL: https://openstaandeschuld-afbetalen.online/belastingdienst/BD7895429/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a04:9a01:1002::33 , Netherlands, ASN34663 (ASBELASTINGDIENST, NL),
Reverse DNS
Software
/
Resource Hash
24c2c8d65ef0423159d5505ed54492d1346611b076c14fd3af08e5364ce83d9e
Security Headers
Name Value
Content-Security-Policy default-src https://*.belastingdienst.nl https://vinden.belastingdienst.nl https://*.readspeaker.com; connect-src 'self' https://*.belastingdienst.nl https://*.optimizely.com https://*.readspeaker.com https://*.abtasty.com https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com https://*.2o7.net https://api.pdok.nl; child-src 'self' https://belastingdienst.nl https://*.belastingdienst.nl https://*.cdn.optimizely.com https://secure.opinionlab.com https://*.readspeaker.com https://www.anbi-instellingen.nl https://www.youtube.com https://www.youtube-nocookie.com https://cm.everesttech.net; frame-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com https://secure.opinionlab.com https://www.youtube.com https://www.youtube-nocookie.com https://*.demdex.net ; frame-ancestors 'self' https://*.belastingdienst.nl https://*.pagefreezer.com https://*.pagefreezer.nl ; img-src 'self' https://n01d05.cumulus-cloud.com https://*.readspeaker.com https://img.youtube.com https://*.demdex.net https://cm.everesttech.net *.2o7.net data: https://*.belastingdienst.nl blob: data: *.abtasty.com; font-src 'self' https://*.belastingdienst.nl blob: data: *.abtasty.com; script-src 'self' https://*.belastingdienst.nl https://cdn.optimizely.com https://*.readspeaker.com https://bdtm.containers.piwik.pro https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com 'unsafe-eval' 'unsafe-inline' blob: *.abtasty.com ; style-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com *.abtasty.com 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://openstaandeschuld-afbetalen.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Sun, 27 Aug 2023 16:25:08 GMT
Content-Security-Policy
default-src https://*.belastingdienst.nl https://vinden.belastingdienst.nl https://*.readspeaker.com; connect-src 'self' https://*.belastingdienst.nl https://*.optimizely.com https://*.readspeaker.com https://*.abtasty.com https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com https://*.2o7.net https://api.pdok.nl; child-src 'self' https://belastingdienst.nl https://*.belastingdienst.nl https://*.cdn.optimizely.com https://secure.opinionlab.com https://*.readspeaker.com https://www.anbi-instellingen.nl https://www.youtube.com https://www.youtube-nocookie.com https://cm.everesttech.net; frame-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com https://secure.opinionlab.com https://www.youtube.com https://www.youtube-nocookie.com https://*.demdex.net ; frame-ancestors 'self' https://*.belastingdienst.nl https://*.pagefreezer.com https://*.pagefreezer.nl ; img-src 'self' https://n01d05.cumulus-cloud.com https://*.readspeaker.com https://img.youtube.com https://*.demdex.net https://cm.everesttech.net *.2o7.net data: https://*.belastingdienst.nl blob: data: *.abtasty.com; font-src 'self' https://*.belastingdienst.nl blob: data: *.abtasty.com; script-src 'self' https://*.belastingdienst.nl https://cdn.optimizely.com https://*.readspeaker.com https://bdtm.containers.piwik.pro https://*.demdex.net https://cm.everesttech.net https://assets.adobedtm.com 'unsafe-eval' 'unsafe-inline' blob: *.abtasty.com ; style-src 'self' https://*.belastingdienst.nl https://*.readspeaker.com *.abtasty.com 'unsafe-inline'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000
Last-Modified
Mon, 21 Aug 2023 07:08:12 GMT
ETag
"454b-603698a9b53a0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
17739
X-XSS-Protection
1; mode=block;
truncated
/ 		325 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8e1259c7006dfe0d19f6bcc4fc622c4ce555250e9924fa20cafbe137e64d72eb

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
54039c085acfdaf5124e55514d4153752a8526dc55b1d76c3bc731bfa4c3863a

Request headers

Referer
Origin
https://openstaandeschuld-afbetalen.online
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		68 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
27c094142b294677babfd410f01ab0ef6450c30f0ced804477f1b98adfc3a591

Request headers

Referer
Origin
https://openstaandeschuld-afbetalen.online
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		82 KB
82 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95b8c28ae6c0c9d5657a44d5a6ca24c04165eef39d6a8e1e93627c8d755ffe3a

Request headers

Referer
Origin
https://openstaandeschuld-afbetalen.online
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/ 		29 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4ec0583dd05c9ae23e4f612829312af92f4b38961c0b1fbf53a266f20d4eb182

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/jpeg
ideal-logo-1024.png
www.ideal.nl/img/logo/ 		51 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.ideal.nl/img/logo/ideal-logo-1024.png
Requested by
Host: openstaandeschuld-afbetalen.online
URL: https://openstaandeschuld-afbetalen.online/belastingdienst/BD7895429/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a03:9700:8000::8182 , Netherlands, ASN20847 (PREVIDER-AS, NL),
Reverse DNS
Software
nginx /
Resource Hash
8c48b81b373e6dac8c9c39072db0ab401be309a8a2a4e2f032cb5d5f2017ae4c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://openstaandeschuld-afbetalen.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sun, 27 Aug 2023 16:25:08 GMT
last-modified
Wed, 21 Oct 2020 12:14:15 GMT
server
nginx
accept-ranges
bytes
etag
"5f902617-ca15"
content-length
51733
content-type
image/png
truncated
/ 		673 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c922548cfe09320db090d544611419072db72918c07a3588e8138bd474eb41d3

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		847 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ea24041f1bf773952f69e1e98082de62b89f24ca6b60b147f2f052b21e3b6861

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		686 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f325b8b3a6c772d7ebef4dea572c8da501e9c6ee286df0d96dfa49441258fd2f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
85f028fadd26412f3ff050e58fab1c791a172e44f078db492c89bbb950053695

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dc4b94fbd1ec10e1ed4e130d8c785c2f0f7a6dacee88c019d3d77782b86d43ba

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dc9b62c0c22ee9ed9efc6b63664e860df4979d42279d6d76d5720beec4c8b239

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76cba8c616494b98ce3232bb080e8beef3583aa75368c65b5e121508f92bb6a4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NL Government (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| savepage_ShadowLoader

0 Cookies