mass.report
Scan Intelligence Report0/100
medium Risk
wintersportdirect.nl
https://wintersportdirect.nl/tsjechie/
IP
185.108.112.123 · Signet B.V
Location
Eindhoven, The Netherlands
Domain Age
6854 days
HTTP
200 · 32.8s
SSL
Valid· E8, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: wintersportdirect.nl
Scanned 2 times since Jun 18, 2026, 02:44 PM UTC
⚠ Medium (45)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
WintersportDirect.nl
Vendors
30/31
Status
partial
✓ spamhaus✓ sophos✗ norton✓ virustotal✓ fortiguard✓ chainpatrol✓ yandex✓ microsoft✓ avast✓ eset✓ brightcloud✓ polyswarm✓ avg✓ bitdefender✓ apple✓ openphish✓ cisa✓ isitphish✓ phishreport✓ urlabuse✓ emsisoft✓ apwg✓ urlquery✓ netcraft✓ urlscan✓ phishtank✓ threatyeti✓ kaspersky✓ drweb✓ google✓ mcafee
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
WintersportDirect.nl
Unknownecommerce | technology | travel · 7/19/2026
Summary
The page presented as Wintersport Tsjechië bookings on wintersportdirect.nl shows branding related to wintersportdirect.nl, but the analyst notes claim a fake image of the original Superbahis site used for phishing. Evidence within the page indicates legitimate WordPress-based structure, multiple third-party scripts, and form POSTs to admin-ajax and tracking endpoints. There is no definitive credential-harvesting form observed in static HTML, and the domain appears to be a legitimate travel/ Ski domain with content in Dutch; however, the analyst-provided context suggests potential impersonation using a known brand image, requiring caution. Based on the scanner data alone, this analysis cannot conclusively confirm phishing; further corroboration of impersonation signals is needed. Analyst context noted: Website is using fake image of the original superbahis.com website and Superbahis brand to phishing and scamming users.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://wintersportdirect.nl/wp-admin/admin-ajax.php, https://region1.google-analytics.com/g/collect?v=2&tid=G-YNGCT67YPX>m=45je66h0h2v9124192070za200zd9124192070&_p=1781793984284&gcd=13l3l3l2l1l1&npa=1&dma_cps=a&dma=1&_eu=EA&are=1&cid=721423797.1781793987&frm=0&ir=1&pscdl=noapi&rcb=15&sr=1280x720&uaa=arm&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CHeadlessChrome%3B145.0.7632.6%7CChromium%3B145.0.7632.6&uam=&uamb=0&uap=Android&uapv=6.0.1&uaw=0&ul=en-us&_s=1&tag_exp=115938466~115938469~118395335~119392696~119392704~119456239~119456247&sid=1781793986&sct=1&seg=0&dl=https%3A%2F%2Fwintersportdirect.nl%2Ftsjechie%2F&dt=Wintersport%20Tsjechi%C3%AB%20boeken%3F%20Vergelijk%20skivakanties%20naar%20Tsjechi%C3%AB&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=6051, https://wct-2.com/track/update-session.
▸Distinctive asset clues: pa.umd.production.min.js, wct.js, main.css, tablet.css, Busreisdirect.png, icon-btn-arrow.svg.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 3
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 105
Hosts: 9
Domains: 8
Suspicious Endpoints
hxxps://wintersportdirect[.]nl/
hxxps://wintersportdirect[.]nl/tsjechie/select-country[]=157
hxxps://wintersportdirect[.]nl/tsjechie/#gf_1
Observed Signals (1)
Analyst-identified phishing kit
Observed Indicators (1)
▸Analyst note claiming use of fake image/branding of another site (Superbahis) for phishing
Risk AssessmentUsed in abuse reports
The scan shows signs that could be associated with a phishing/impersonation attempt (branding discussion in analyst notes, potential use of fake imagery). However, the live HTML indicates WintersportDirect.nl is serving a Dutch travel content page with legitimate WordPress assets, several third-party widgets, and usual analytics. The evidence is inconclusive for definitive credential theft or impersonation solely from the technical signals; due diligence and domain-brand alignment confirmation are required. Recommend monitoring and further verification of branding usage and any impersonation indicators beyond this snapshot. Analyst context was provided and corroborated during this assessment (Website is using fake image of the original superbahis.com website and Superbahis brand to phishing and scamming users.). Because analyst context identifies an active phishing or fraud kit, domain suspension is recommended rather than passive monitoring.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API