# PhishDestroy domain threat record: itelligent.nl

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/itelligent.nl/
Machine-readable companion: https://phishdestroy.io/domain/itelligent.nl/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 22:08:42 UTC
- Last availability or vendor check: 2026-10-22 10:25:39 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: scroll

## Stored infrastructure

- Observed IP address: 87.236.102.46
- Registrar in stored WHOIS data: The Registrar Company B.V.
- Registrar country in stored WHOIS data: NL
- Last stored HTTP status: 200
- Registration date (registry RDAP, itelligent.nl): 1998-09-22 08:34:26 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127da-edb8-779f-a7f4-cec08ac09dcd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/itelligent.nl
- Certificate Transparency search: https://crt.sh/?q=%25.itelligent.nl
- Web Archive lookup: https://web.archive.org/web/*/https://itelligent.nl/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
itelligent.nl is a Dutch domain that PhishDestroy classifies as an impersonation phishing page. It presents itself as "ITelligent – Staff Supplementation," an IT staffing service, which makes contractors, job seekers and companies looking for technical staff the likely audience. PhishDestroy first flagged it on 2026-10-11. As of 2026-10-19 the site was still online and serving content.

How the scam works
Impersonation pages borrow the name and look of a real business so visitors trust them with contact details, logins, documents or payments. A staffing front is a convenient disguise because recruitment naturally involves asking for CVs, identity documents, bank details and signed contracts. Whatever a visitor submits goes to the operator and can be reused for account takeover, identity fraud or follow-up scams. The page title describes an ordinary staff supplementation business, while our classification is impersonation phishing.

Evidence
Six of 92 VirusTotal engines flagged the domain when it was scanned on 2026-10-12: alphaMountain.ai, Fortinet, Gridinsoft, Seclookup, SOCRadar and URLQuery. That is a minority of engines, but it comes from several unrelated vendors, so the verdict does not rest on a single source. The domain also appears in 34 AlienVault OTX threat pulses, which means other researchers have been tracking it. Among public blocklists, only PhishDestroy lists it so far.

Infrastructure
The domain was registered on 1998-09-22, almost three decades before PhishDestroy detected it. That age gives it a credibility that freshly registered phishing domains lack. It is registered through The Registrar Company B.V. and hosted on LeaseWeb Netherlands B.V. in the Netherlands, which matches its Dutch identity. The HTTPS certificate comes from Let's Encrypt, so the padlock only shows the connection is encrypted and says nothing about whether the business is genuine.

What to do
If you entered a password on this site, change it immediately, along with any other account that uses the same password, and turn on two-factor authentication. If you sent a CV, ID scans or bank details, watch for unexpected contact claiming to be a recruiter or employer. Alert your bank about any payment details you shared, and consider fraud monitoring if identity documents were exposed. Do not pay any "onboarding," "placement" or verification fees requested through this site or its contacts. Defenders should block the domain at the DNS and proxy level and search mail and web logs for users who interacted with it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127da-edb8-779f-a7f4-cec08ac09dcd/
VirusTotal report: https://www.virustotal.com/gui/domain/itelligent.nl
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=itelligent.nl
Archived copy: https://web.archive.org/web/20261010213728/https://itelligent.nl/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:26 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/FL6NXQs0/9bc24153b989.png
  Captured: 2026-10-10 22:08:42 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a127da-edb8-779f-a7f4-cec08ac09dcd.png
  Captured: 2026-10-10 22:08:42 UTC
  Source report: https://urlscan.io/result/01a127da-edb8-779f-a7f4-cec08ac09dcd/
- URLScan capture 2: https://urlscan.io/screenshots/01a101ce-e480-70db-a855-fbe708a48d80.png
  Captured: 2026-10-10 21:35:30 UTC
  Source report: https://urlscan.io/result/01a127da-edb8-779f-a7f4-cec08ac09dcd/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/492eca9d-17b6-4641-ba86-cffc0db38cfd.png
  Captured: 2026-10-12 11:52:09 UTC
  Source report: https://radar.cloudflare.com/scan/492eca9d-17b6-4641-ba86-cffc0db38cfd
  SHA-256: 6571281e99e4332f917e9d1dca9b6551839cec156f925a2f6d89da2bf664f524
- URLQuery: https://screenshots.phishdestroy.io/uq/10dcef10-8d5e-449e-8381-45d74b3d46fc.png
  Source report: https://urlquery.net/report/10dcef10-8d5e-449e-8381-45d74b3d46fc
  SHA-256: a5c9c56951ae0522e41a36fe1d886e575dd65a5b91081d5ea256fd6f0da41f18
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e375-10a9-72de-9f92-3a6c16ea2588.png
  Captured: 2026-09-27 15:21:50 UTC
  Source report: https://urlscan.io/result/01a0e375-10a9-72de-9f92-3a6c16ea2588/
  SHA-256: 163ff457c4e96e1491e5ea1a54922fd05510d055f9fe8099f163896a6e6e3c46
- URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a101ce-e480-70db-a855-fbe708a48d80.png
  Captured: 2026-10-03 12:48:25 UTC
  Source report: https://urlscan.io/result/01a101ce-e480-70db-a855-fbe708a48d80/
  SHA-256: 163ff457c4e96e1491e5ea1a54922fd05510d055f9fe8099f163896a6e6e3c46
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127c1-4d4b-731d-9b31-b27dde3e50bb.png
  Captured: 2026-10-10 21:39:09 UTC
  Source report: https://urlscan.io/result/01a127c1-4d4b-731d-9b31-b27dde3e50bb/
  SHA-256: bb4f196f282cf7eabc7e00241adabb4d8fc3892b3b3a253450cfae85934a1e95
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127c7-26b0-760a-a691-a8256cc8478f.png
  Captured: 2026-10-10 21:45:32 UTC
  Source report: https://urlscan.io/result/01a127c7-26b0-760a-a691-a8256cc8478f/
  SHA-256: bb4f196f282cf7eabc7e00241adabb4d8fc3892b3b3a253450cfae85934a1e95

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:40Z",
        "uuid": "01a127da-edb8-779f-a7f4-cec08ac09dcd",
        "scanned_at": "2026-10-10T22:07:11Z",
        "final_url": "https://itelligent.nl/home-mobile/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://itelligent.nl/",
                "from": "http://itelligent.nl/",
                "status": 307
            },
            {
                "to": "https://itelligent.nl/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f",
                "from": "https://itelligent.nl/"
            },
            {
                "to": "https://itelligent.nl/",
                "from": "https://itelligent.nl/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f",
                "status": 302
            },
            {
                "to": "https://itelligent.nl/home-mobile",
                "from": "https://itelligent.nl/",
                "status": 302
            },
            {
                "to": "https://itelligent.nl/home-mobile/",
                "from": "https://itelligent.nl/home-mobile",
                "status": 301
            }
        ],
        "ip": "87.236.102.46",
        "ptr": "da131.direct-admin-server.com",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.250.190.227",
            "142.251.40.234",
            "87.236.102.46"
        ],
        "asns": [
            "15169",
            "60781"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "doc_hash": "967d46225f37a915943a65a39571208d3bb7736c0f80be39913f730d5f93193c",
        "script_hashes": [
            "1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df",
            "48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d",
            "37c5f58f12814dd0ecc28f15b7765c6bcd31a9479d330b4ef896e140bf89dc38",
            "3d240c871f5edb4ab18ae2ad6e0c4986b3c916efe431a8060ed79324f1d19aae"
        ],
        "globals": [
            "_wpemojiSettings",
            "jQuery",
            "avia_is_mobile",
            "avia_framework_globals",
            "wp",
            "Froogaloop",
            "Waypoint",
            "onYouTubeIframeAPIReady",
            "$f",
            "jQuery112408099904650372243"
        ],
        "cookies": [
            "wssplashchk"
        ],
        "tls": {
            "san": [
                "itelligent.nl",
                "www.itelligent.nl"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "itelligent.nl",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-09T17:16:32Z",
            "valid_from": "2026-09-10T17:16:33Z"
        },
        "domain_age_days": 4946,
        "apex_age_days": 4946,
        "tls_age_days": 30,
        "tls_valid_days": 89,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -20,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "openresty/1.31.1.1",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:06Z",
        "uuid": "492eca9d-17b6-4641-ba86-cffc0db38cfd",
        "scanned_at": "2026-10-12T11:52:09Z",
        "final_url": "https://itelligent.nl/",
        "status": 200,
        "history": [
            {
                "url": "https://itelligent.nl/",
                "status": 200
            }
        ],
        "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331",
        "doc_hash": "32219bc2781394d547cb1ff0624be1b41f8e2dcd47e864f4b888c661ac57a856",
        "domain_risks": [
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "itelligent.nl",
                "type": "A",
                "value": "87.236.102.46"
            }
        ],
        "dnssec_valid": true,
        "ip": "87.236.102.46",
        "whois": {
            "registrar": "The Registrar Company B.V.",
            "created": "1998-09-22T08:34:26Z",
            "updated": "2025-04-30T22:14:05Z",
            "nameservers": [
                "ns3.thednscompany.com",
                "ns2.thednscompany.com",
                "ns1.thednscompany.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:50Z",
        "analysis_at": "2026-10-10T22:48:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "Fortinet": "malware",
            "SOCRadar": "suspicious",
            "URLQuery": "suspicious",
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "alphaMountain.ai": "malicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Information Technology, Malicious (alphaMountain.ai)"
        },
        "popularity": {
            "Alexa": 670193,
            "Statvoo": 670193
        },
        "created": "1998-09-22T00:00:00Z",
        "updated": "2025-04-30T00:00:00Z",
        "first_seen": "2023-10-05T12:48:37Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.thednscompany.com"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 ip4:77.249.175.224 include:_spf.freshsales.io include:_spf.exactonline.nl include:servers.mcsv.net include:spf.protection.outlook.com -all"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "ns1.thednscompany.com",
                "value": "ns1.thednscompany.com"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "ITelligent-nl.mail.protection.outlook.com",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "87.236.102.46"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "MS=3D6C5BCFE16593F977217303DF88EAF8059868E3"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.thednscompany.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.thednscompany.com"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "MS=ms82555872"
            }
        ],
        "dns_at": "2026-10-10T22:56:52Z",
        "jarm": "29d29d16d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1",
        "cert": {
            "san": [
                "itelligent.nl",
                "www.itelligent.nl"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5b2135b53dfe8aaec2d943787fc0f02ed4f",
            "sha256": "b2bf90d23c15ebdcee8668b54da5c5ae44b72ebcadcc56d9994b589769270de4",
            "subject": "itelligent.nl",
            "valid_to": "2026-12-09T17:16:32Z",
            "valid_from": "2026-09-10T17:16:33Z"
        },
        "whois": {
            "created": "1998-09-22T00:00:00Z",
            "updated": "2025-04-30T00:00:00Z",
            "dnssec": "yes"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2025-04-30T22:14:05Z",
                "registration": "1998-09-22T08:34:26Z",
                "last update of RDAP database": "2026-10-10T22:56:52Z"
            },
            "registrar": "The Registrar Company B.V.",
            "registrar_iana_id": "0000"
        }
    }
}
```