# PhishDestroy domain threat record: bhmaatcalculator.nl

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bhmaatcalculator.nl/
Machine-readable companion: https://phishdestroy.io/domain/bhmaatcalculator.nl/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 22:04:26 UTC
- Last availability or vendor check: 2026-10-22 10:26:38 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ankr

## Stored infrastructure

- Observed IP address: 172.67.194.182
- Registrar in stored WHOIS data: ILKARI DOMAINS LIMITED
- Registrar country in stored WHOIS data: IE
- Last stored HTTP status: 200
- Registration date (registry RDAP, bhmaatcalculator.nl): 2026-05-04 00:25:53 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127d6-b50b-71ba-bff5-18c7c5ec412f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bhmaatcalculator.nl
- Certificate Transparency search: https://crt.sh/?q=%25.bhmaatcalculator.nl
- Web Archive lookup: https://web.archive.org/web/*/https://bhmaatcalculator.nl/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
bhmaatcalculator.nl is a Dutch-language site that PhishDestroy classifies as an impersonation phishing page. It presents itself under the title "10 euro deposit casino: uitleg over minimale storting", an explainer on minimum casino deposits written for Dutch speakers. PhishDestroy first flagged it on 2026-10-11, and on 2026-10-19 the site was still online with its content live.

How the scam works
Impersonation pages borrow the look and authority of a trusted service so that visitors act without second-guessing. A low-stakes hook like a 10 euro minimum deposit lowers a visitor's guard and nudges them toward a casino account, a payment form or a login page. Anything entered can end up with the operators, including card details, deposits, account credentials or identity documents requested as "verification". The page title shows a casino deposit explainer, while our classification is impersonation phishing.

Evidence
Six of 92 VirusTotal engines flagged the domain in a check on 2026-10-12: alphaMountain.ai, Chong Lua Dao, Dr.Web, Gridinsoft, Seclookup and SOCRadar. That is a modest count, but it comes from a varied mix of commercial and community vendors that reached the same verdict independently. The domain also appears in 34 AlienVault OTX threat pulses, which shows it is already being tracked in shared threat intelligence. The PhishDestroy blocklist lists it.

Infrastructure
The domain was registered on 2026-05-04 through ILKARI DOMAINS LIMITED, roughly five months before PhishDestroy detected it. That gap is long enough for a domain to build some age and reputation before it is put to use. The site resolves to Cloudflare's network in the US, so the address visitors reach is a proxy that hides the real origin server.

What to do
If you deposited money or entered card details through this site, contact your bank or card issuer right away to dispute the charges and block the card. Do not pay any further "fees" or "verification deposits" to release a balance. If you created an account or logged in with a password you use elsewhere, change it on those other services and turn on two-factor authentication. If you uploaded ID documents, watch for identity misuse. Defenders should block the domain at DNS and proxy level, report it to the registrar and Cloudflare's abuse channels, and watch for other Dutch-language casino lures that follow the same pattern.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127d6-b50b-71ba-bff5-18c7c5ec412f/
VirusTotal report: https://www.virustotal.com/gui/domain/bhmaatcalculator.nl
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bhmaatcalculator.nl
Archived copy: https://web.archive.org/web/20260206201705/https://bhmaatcalculator.nl/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:27 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a127d6-b50b-71ba-bff5-18c7c5ec412f.png
  Captured: 2026-10-10 22:04:26 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a127d6-b50b-71ba-bff5-18c7c5ec412f.png
  Captured: 2026-10-10 22:04:26 UTC
  Source report: https://urlscan.io/result/01a127d6-b50b-71ba-bff5-18c7c5ec412f/
- URLScan capture 2: https://urlscan.io/screenshots/01a06883-a206-77ec-9819-abf935da1a3a.png
  Captured: 2026-10-10 21:43:49 UTC
  Source report: https://urlscan.io/result/01a127d6-b50b-71ba-bff5-18c7c5ec412f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a0bda672-057a-4ae0-99bb-9c2c50ca90b9.png
  Captured: 2026-10-12 11:41:52 UTC
  Source report: https://radar.cloudflare.com/scan/a0bda672-057a-4ae0-99bb-9c2c50ca90b9
  SHA-256: 300726eaa7d813f99854510d9881772ed72f24d7f137fab0ece1c2bf24dc5aaa
- URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a06883-a206-77ec-9819-abf935da1a3a.png
  Captured: 2026-09-03 18:24:18 UTC
  Source report: https://urlscan.io/result/01a06883-a206-77ec-9819-abf935da1a3a/
  SHA-256: f6876dfe5ae65e2d784c7860321686f916f16da1b6e031d7570ce5e4bdfbda75

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:43Z",
        "uuid": "01a127d6-b50b-71ba-bff5-18c7c5ec412f",
        "scanned_at": "2026-10-10T22:02:30Z",
        "final_url": "https://bhmaatcalculator.nl/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bhmaatcalculator.nl/",
                "from": "http://bhmaatcalculator.nl/",
                "status": 307
            }
        ],
        "ip": "172.67.194.182",
        "ips": [
            "172.67.194.182"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "1redlink.com",
            "linkshter.com",
            "wolfaffiliates.app",
            "boomtraff.com",
            "0xtraff.com",
            "go.affiliatemystake.com",
            "openovergokken.nl"
        ],
        "doc_hash": "3c63fee7a0ebd6e82e614e0d4bf199bbd1d43eef18a3c518a06a3589f3942dfc",
        "tls": {
            "san": [
                "bhmaatcalculator.nl"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "bhmaatcalculator.nl",
            "protocol": "QUIC",
            "valid_to": "2026-11-18T08:52:27Z",
            "valid_from": "2026-08-20T07:52:29Z"
        },
        "domain_age_days": 3612,
        "apex_age_days": 3612,
        "tls_age_days": 51,
        "tls_valid_days": 90,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -33,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:06Z",
        "uuid": "a0bda672-057a-4ae0-99bb-9c2c50ca90b9",
        "scanned_at": "2026-10-12T11:41:52Z",
        "final_url": "https://bhmaatcalculator.nl/",
        "status": 200,
        "history": [
            {
                "url": "https://bhmaatcalculator.nl/",
                "status": 200
            }
        ],
        "dom_hash": "a2b3a32ab2451b064df54707bc859b96fa378539d756b20782c73f7fc7e338e9",
        "doc_hash": "b01d32e4100a526ce27461fc4be5dd409a95a30df33e6fb93c65114b89913610",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bhmaatcalculator.nl",
                "type": "A",
                "value": "104.21.20.224"
            },
            {
                "name": "bhmaatcalculator.nl",
                "type": "A",
                "value": "172.67.194.182"
            },
            {
                "name": "bhmaatcalculator.nl",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:c2b6"
            },
            {
                "name": "bhmaatcalculator.nl",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:14e0"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.20.224",
        "whois": {
            "registrar": "ILKARI DOMAINS LIMITED",
            "created": "2026-05-04T00:25:53Z",
            "updated": "2026-08-20T08:14:29Z",
            "nameservers": [
                "sarah.ns.cloudflare.com",
                "kyle.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:53Z",
        "analysis_at": "2026-10-13T02:17:29Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 7,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "Dr.Web": "malicious",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Malicious (alphaMountain.ai)"
        },
        "popularity": {
            "Alexa": 630235,
            "Statvoo": 667964
        },
        "created": "2026-05-04T00:00:00Z",
        "updated": "2026-08-20T00:00:00Z",
        "first_seen": "2023-10-05T12:49:08Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "kyle.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:14e0"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.20.224"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.194.182"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sarah.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "route1.mx.cloudflare.net",
                "priority": 49
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kyle.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:c2b6"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "route2.mx.cloudflare.net",
                "priority": 56
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 include:_spf.mx.cloudflare.net ~all"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=E4YGhOwnyLQwN6uDsIL7VeAmtyAg0UpT-SuVJgi41Hw"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "route3.mx.cloudflare.net",
                "priority": 33
            }
        ],
        "dns_at": "2026-10-13T02:24:51Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "bhmaatcalculator.nl"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "dee525b022dd22330e0a829f5c582b73",
            "sha256": "228cf0ecbe9db1821fe15b4a5c0db613f4e0080983d586c97efe313907eff67f",
            "subject": "bhmaatcalculator.nl",
            "valid_to": "2026-11-18T08:52:27Z",
            "valid_from": "2026-08-20T07:52:29Z"
        },
        "whois": {
            "created": "2026-05-04T00:00:00Z",
            "updated": "2026-08-20T00:00:00Z",
            "dnssec": "no"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-20T08:14:29Z",
                "registration": "2026-05-04T00:25:53Z",
                "last update of RDAP database": "2026-10-13T02:24:50Z"
            },
            "registrar": "ILKARI DOMAINS LIMITED",
            "registrar_iana_id": "0000"
        }
    }
}
```