mass.report
Scan Intelligence Report0/100
medium Risk
wintersportdirect.nl
https://wintersportdirect.nl/tsjechie/
IP
185.108.112.123 · Signet B.V
Location
Eindhoven, The Netherlands
Domain Age
6854 days
HTTP
200 · 33.2s
SSL
Valid· E8, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: wintersportdirect.nl
Scanned 2 times since Jun 18, 2026, 02:44 PM UTC
⚠ Medium (45)
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Wintersportdirect.nl
Unknowntravel · 7/19/2026
Summary
The page presents Wintersport Tsjechië branding on wintersportdirect.nl. While the domain appears legitimate as a Dutch travel site, the page design and content focus on skiing in the Czech Republic. No clear credential-phishing surfaces (no login form harvesting of user credentials on an impersonated brand). However, the page shows multiple external scripts and trackers, plus suspicious endpoints and a POST to wp-admin/admin-ajax.php, suggesting potential data collection or user interaction that could be abused. The combination of brand-aligned visuals with off-domain analytics endpoints warrants closer monitoring for potential first-party abuse or data leakage, though impersonation is not definitively demonstrated by the evidence provided.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://wintersportdirect.nl/wp-admin/admin-ajax.php, https://region1.google-analytics.com/g/collect?v=2&tid=G-YNGCT67YPX>m=45je66g1h1v9124192070za200zd9124192070&_p=1781793892772&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&_eu=EA&are=1&cid=808776710.1781793895&frm=0&ir=1&pscdl=noapi&rcb=14&sr=1280x720&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CHeadlessChrome%3B145.0.7632.6%7CChromium%3B145.0.7632.6&uam=&uamb=0&uap=Windows&uapv=10.0&uaw=0&ul=en-us&_s=1&tag_exp=115616986~115938465~115938468~119392696~119392704~119456239~119456247&sid=1781793895&sct=1&seg=0&dl=https%3A%2F%2Fwintersportdirect.nl%2Ftsjechie%2F&dt=Wintersport%20Tsjechi%C3%AB%20boeken%3F%20Vergelijk%20skivakanties%20naar%20Tsjechi%C3%AB&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=5850, https://wct-2.com/track/update-session.
▸Distinctive asset clues: wct.js, pa.umd.production.min.js, main.css, tablet.css, Busreisdirect.png, icon-btn-arrow.svg.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 3
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 105
Hosts: 9
Domains: 8
Suspicious Endpoints
hxxps://wintersportdirect[.]nl/
hxxps://wintersportdirect[.]nl/tsjechie/select-country[]=157
hxxps://wintersportdirect[.]nl/tsjechie/#gf_1
Attack Techniques (0)
Indicators of Compromise (0)
No specific IOCs identified in source
Risk AssessmentUsed in abuse reports
The page is a real first-party site (wintersportdirect.nl) presenting Wintersport Tsjechië branding. However, the presence of numerous external trackers, analytics endpoints, and a POST flow to admin-ajax.php alongside an unusual landing page with country selector suggests potential data collection behavior that could be abused if misconfigured. There is no explicit credential phishing on this page, but the combination of tracking load and suspicious POST targets warrants monitoring for data leakage or misuse. Recommend ongoing monitoring and internal review of data collection endpoints; no definitive takedown action at this time, but flag for abuse review if user data exposure is observed.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API