# PhishDestroy domain threat record: api.gelukkigewinnaars.nl

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/api.gelukkigewinnaars.nl/
Machine-readable companion: https://phishdestroy.io/domain/api.gelukkigewinnaars.nl/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-21 20:47:42 UTC
- Last availability or vendor check: 2026-10-22 10:49:31 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 8/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 86.105.244.1
- Registrar in stored WHOIS data: team.blue nl B.V.
- Registrar country in stored WHOIS data: NL
- Last stored HTTP status: 200
- Registration date (registry RDAP, gelukkigewinnaars.nl): 2022-05-03 14:22:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16036-d8fd-7305-84be-57ee76d64382/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/api.gelukkigewinnaars.nl
- Certificate Transparency search: https://crt.sh/?q=%25.api.gelukkigewinnaars.nl
- Web Archive lookup: https://web.archive.org/web/*/https://api.gelukkigewinnaars.nl/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added api.gelukkigewinnaars.nl to its internal blocklist on 2026-10-21. The page returned a 200 HTTP status and the title "TransIP - Reserved domain". The intake reason cites eight malicious detections on VirusTotal as the primary indicator. No external blocklists reported the domain.

How the scam works
The domain is classified as a suspicious domain, meaning it has been flagged by multiple security engines without a confirmed malicious payload observed. Such domains are often used for phishing, malware hosting, or credential harvesting, but no specific exploit or form was seen on the captured page. The reserved‑domain page itself does not contain malicious code, yet the aggregate detections raise a risk that the domain could be repurposed for abuse.

Evidence
VirusTotal scans on 2026-10-15 recorded eight malicious detections from AlphaMountain.ai, BitDefender, CRDF, DNS8, G-Data, Gridinsoft, SOCRadar and VIPRE. Google Safe Browsing checked on 2026-10-21 reported no flag. URLScan captures on 2026-09-13 and 2026-10-21 both returned clean verdicts with no malicious tags. OTX listed zero pulses as of 2026-10-21, and PhishDestroy’s internal blocklist marked the domain true while external blocklists showed zero entries.

Infrastructure
DNS resolution returned A 86.105.244.1 (owned by Signet B.V in the Netherlands) and AAAA 2a01:7c8:e100:1::50a0. The domain’s TLS certificate from Let’s Encrypt is valid 2026-08-07 to 2026-11-05 for *.gelukkigewinnaars.nl. The domain was created 848 days ago, the apex zone 1,632 days ago, and the nameservers are ns0.transip.net, ns1.transip.nl and ns2.transip.eu. The web server identified as Apache served a simple HTML page.

What to do
Users should not submit login credentials, personal data, or cryptocurrency information to this domain; if they have, they should change any affected passwords. Network defenders can block the exact hostname api.gelukkigewinnaars.nl and monitor outbound traffic for connections to its IP addresses. Treat the VirusTotal detections as an indicator of risk and investigate any related activity in logs or endpoint alerts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16036-d8fd-7305-84be-57ee76d64382/
Cloudflare Radar report: https://radar.cloudflare.com/scan/232a96b3-cfb5-4a88-8342-ef0df8ac1f44
URLQuery report: https://urlquery.net/report/5131f33c-3be3-4140-9217-ca46be7b847b
Stored capture screenshot: https://i.ibb.co/jPpzwFVy/2b49fbddf551.png
Cloudflare Radar screenshot (2026-10-21T21:20:27Z): https://screenshots.phishdestroy.io/cf/232a96b3-cfb5-4a88-8342-ef0df8ac1f44.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/5131f33c-3be3-4140-9217-ca46be7b847b.png
URLScan screenshot (2026-09-09T18:00:11Z): https://screenshots.phishdestroy.io/us/01a08753-b4aa-702e-96f3-c9ea9be1c873.png
URLScan capture report: https://urlscan.io/result/01a08753-b4aa-702e-96f3-c9ea9be1c873/
URLScan screenshot (2026-09-13T16:32:43Z): https://screenshots.phishdestroy.io/us/01a09b9c-eda2-740c-a21c-13df1cb6fe99.png
URLScan capture report: https://urlscan.io/result/01a09b9c-eda2-740c-a21c-13df1cb6fe99/
URLScan screenshot (2026-10-21T20:50:16Z): https://screenshots.phishdestroy.io/us/01a1603a-86ac-7300-9b04-2360d4c14bce.png
URLScan capture report: https://urlscan.io/result/01a1603a-86ac-7300-9b04-2360d4c14bce/
VirusTotal report: https://www.virustotal.com/gui/domain/api.gelukkigewinnaars.nl
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=api.gelukkigewinnaars.nl
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 21:22:47 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/jPpzwFVy/2b49fbddf551.png
  Captured: 2026-10-21 20:47:42 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a16036-d8fd-7305-84be-57ee76d64382.png
  Captured: 2026-10-21 20:47:42 UTC
  Source report: https://urlscan.io/result/01a16036-d8fd-7305-84be-57ee76d64382/
- URLScan capture 2: https://urlscan.io/screenshots/01a09b9c-eda2-740c-a21c-13df1cb6fe99.png
  Captured: 2026-10-21 20:44:04 UTC
  Source report: https://urlscan.io/result/01a16036-d8fd-7305-84be-57ee76d64382/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/232a96b3-cfb5-4a88-8342-ef0df8ac1f44.png
  Captured: 2026-10-21 21:20:27 UTC
  Source report: https://radar.cloudflare.com/scan/232a96b3-cfb5-4a88-8342-ef0df8ac1f44
  SHA-256: a0e1aca5a10eb50a4edc4c467b47ceb884a4cf32aefe721b5f9c5da130be9979
- URLQuery: https://screenshots.phishdestroy.io/uq/5131f33c-3be3-4140-9217-ca46be7b847b.png
  Source report: https://urlquery.net/report/5131f33c-3be3-4140-9217-ca46be7b847b
  SHA-256: 8cf58bba04eaae8506f689309f70a4c5a790cbd6d6c90f2a69abf99667b2cb2f
- URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a08753-b4aa-702e-96f3-c9ea9be1c873.png
  Captured: 2026-09-09 18:00:11 UTC
  Source report: https://urlscan.io/result/01a08753-b4aa-702e-96f3-c9ea9be1c873/
  SHA-256: 7b8adc4f8800879dadcf288df4e3e0ad2adc09360b7ab63b6579fdca634e1c24
- URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09b9c-eda2-740c-a21c-13df1cb6fe99.png
  Captured: 2026-09-13 16:32:43 UTC
  Source report: https://urlscan.io/result/01a09b9c-eda2-740c-a21c-13df1cb6fe99/
  SHA-256: 2e756a11ca153c2295009ecd832fd2acf084f4b039dcaa248a8cb4a7d0e5835c
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a1603a-86ac-7300-9b04-2360d4c14bce.png
  Captured: 2026-10-21 20:50:16 UTC
  Source report: https://urlscan.io/result/01a1603a-86ac-7300-9b04-2360d4c14bce/
  SHA-256: 9de3b1810b2e0499170a55f73122dc1fcfdd0eaa07bbfa451bd21b0df2a947c1

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T21:16:21Z",
        "uuid": "01a16036-d8fd-7305-84be-57ee76d64382",
        "scanned_at": "2026-10-21T20:46:18Z",
        "final_url": "https://api.gelukkigewinnaars.nl/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://api.gelukkigewinnaars.nl/",
                "from": "http://api.gelukkigewinnaars.nl/",
                "status": 307
            }
        ],
        "ip": "86.105.244.1",
        "ptr": "webhosting.transip.nl",
        "domains": [
            "reserved.transip.nl",
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.163.94",
            "37.97.254.27",
            "172.253.122.95",
            "86.105.244.1"
        ],
        "asns": [
            "15169",
            "20857"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "link_domains": [
            "transip.nl",
            "transip.eu",
            "www.transip.nl",
            "www.transip.eu",
            "nl.trustpilot.com",
            "trustpilot.com"
        ],
        "doc_hash": "117a61ad457cb776ca2e337cc04dce86510931b1e311b02e709a5e6c486333c4",
        "globals": [
            "sltlds",
            "switchLanguage",
            "hideClass",
            "showClass",
            "hide",
            "show",
            "loadHeaderVideo",
            "determineFiletype",
            "showVideoOverlay",
            "hideVideoOverlay",
            "showVideoInline",
            "replaceDomainLabels",
            "getDomainParts",
            "elements",
            "container",
            "style",
            "video",
            "element",
            "type",
            "host",
            "dom",
            "tld",
            "domain"
        ],
        "tls": {
            "san": [
                "*.gelukkigewinnaars.nl",
                "gelukkigewinnaars.nl"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "*.gelukkigewinnaars.nl",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T16:47:45Z",
            "valid_from": "2026-10-15T16:47:46Z"
        },
        "domain_age_days": 848,
        "apex_age_days": 1632,
        "tls_age_days": 6,
        "tls_valid_days": 89,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -45,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T21:21:52Z",
        "uuid": "232a96b3-cfb5-4a88-8342-ef0df8ac1f44",
        "scanned_at": "2026-10-21T21:20:27Z",
        "final_url": "https://api.gelukkigewinnaars.nl/",
        "status": 200,
        "history": [
            {
                "url": "https://api.gelukkigewinnaars.nl/",
                "status": 200
            }
        ],
        "dom_hash": "44213051d72ad7c85a5e8918006ba69f2f7cf62df75dbd77ec9ad34119e2cf1c",
        "doc_hash": "117a61ad457cb776ca2e337cc04dce86510931b1e311b02e709a5e6c486333c4",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "api.gelukkigewinnaars.nl",
                "type": "A",
                "value": "86.105.244.1"
            },
            {
                "name": "api.gelukkigewinnaars.nl",
                "type": "AAAA",
                "value": "2a01:7c8:e100:1::50a0"
            }
        ],
        "dnssec_valid": true,
        "ip": "86.105.244.1",
        "whois": {
            "registrar": "team.blue nl B.V.",
            "created": "2022-05-03T14:22:58Z",
            "updated": "2024-06-07T09:10:27Z",
            "nameservers": [
                "ns2.transip.eu",
                "ns1.transip.nl",
                "ns0.transip.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T21:19:48Z",
        "analysis_at": "2026-10-15T06:54:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 8,
            "suspicious": 0,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "VIPRE": "phishing",
            "G-Data": "malware",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "malware",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "created": "2022-05-03T00:00:00Z",
        "updated": "2024-06-07T00:00:00Z",
        "first_seen": "2024-09-07T02:31:18Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a01:7c8:e100:1::50a0"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "86.105.244.1"
            }
        ],
        "dns_at": "2026-10-15T06:57:04Z",
        "jarm": "2ad2ad16d2ad2ad00042d42d0000004b86cf883937e6feb1dd39cad97eaf62",
        "cert": {
            "san": [
                "*.gelukkigewinnaars.nl",
                "gelukkigewinnaars.nl"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6a91244264cea232490dddc2b2c95fc1d7d",
            "sha256": "4e9d724f55368b1f20aeafce3b9a805b1d762570bcb66e2cdb11a1222b1b708e",
            "subject": "*.gelukkigewinnaars.nl",
            "valid_to": "2026-11-05T12:25:40Z",
            "valid_from": "2026-08-07T12:25:41Z"
        },
        "whois": {
            "created": "2022-05-03T00:00:00Z",
            "updated": "2024-06-07T00:00:00Z",
            "dnssec": "yes"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T21:22:04Z",
        "caa_records": {
            "domain": "api.gelukkigewinnaars.nl"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-21T20:51:01Z",
            "first": "2024-09-06T13:36:35Z",
            "changes": 1,
            "days_archived": 5,
            "scans_per_day": 0.01,
            "avg_page_bytes": 2351
        },
        "social_tags": {
            "title": "TransIP - Reserved domainBezet!",
            "robots": "noindex, nofollow",
            "description": "TransIP - Reserved domain"
        },
        "trackers": {
            "requests": 15,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://reserved.transip.nl/assets/js/_sltlds.js",
                "https://reserved.transip.nl/assets/js/reserved-min.js"
            ],
            "third_party_scripts": 2
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 271,
                "tls": 31,
                "wait": 36,
                "connect": 15,
                "download": 50
            },
            "response_ms": 403
        },
        "tls_connection": {
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 64703,
            "co2_grams": 0.0024,
            "cleaner_than": 31
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "195.8.195.195",
                    "host": "ns1.transip.nl"
                },
                {
                    "ip": "37.97.199.195",
                    "host": "ns2.transip.eu"
                },
                {
                    "ip": "195.135.195.195",
                    "host": "ns0.transip.net"
                }
            ],
            "zone": "gelukkigewinnaars.nl"
        },
        "location": {
            "ip": "2a01:7c8:e100:1::50a0",
            "asn": "20857",
            "org": "Signet B.V",
            "city": "Leiden",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "*.gelukkigewinnaars.nl"
        },
        "dns": {
            "A": [
                "86.105.244.1"
            ],
            "AAAA": [
                "2a01:7c8:e100:1::50a0"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": true,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "2a01:7c8:e100:1::50a0",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://api.gelukkigewinnaars.nl"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Apache HTTP Server",
                "Google Font API"
            ]
        },
        "linked_pages": {
            "external": [
                "https://transip.nl/",
                "https://transip.eu/",
                "https://transip.nl/cp/",
                "https://transip.eu/cp/",
                "https://www.transip.nl/knowledgebase/5885-een-eigen-website-beginnen",
                "https://www.transip.eu/knowledgebase/entry/5885/",
                "https://www.transip.nl/vragen/110000580/",
                "https://www.transip.eu/knowledgebase/entry/284-start-sending-receiving-email-domain/",
                "https://www.transip.nl/vragen/198/",
                "https://www.transip.eu/question/100000230",
                "https://www.transip.nl/vragen/110000534/",
                "https://www.transip.eu/question/110000577/",
                "https://nl.trustpilot.com/review/www.transip.nl",
                "https://trustpilot.com/review/www.transip.nl",
                "https://www.transip.nl/algemene-voorwaarden/",
                "https://www.transip.eu/terms-of-service/",
                "https://www.transip.nl/privacy-policy/",
                "https://www.transip.eu/privacy-policy/"
            ],
            "external_count": 18
        },
        "whois": {
            "registrar": "team.blue nl B.V. Vondellaan 47 2332AA Leiden Netherlands SIDN BV",
            "created": "2022-05-03T00:00:00Z",
            "updated": "2024-06-07T00:00:00Z",
            "status": [
                "active"
            ],
            "nameservers": [
                "ns2.transip.eu",
                "ns1.transip.nl",
                "ns0.transip.net"
            ]
        },
        "headers": {
            "headers": {
                "server": "Apache",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```