mijn[.]belastingdienst[.]nl[.]kzxj5hqaf2c8scftx643rq72xggmaa86es9zjgs578tqm1drafbq[.]dentisttodentistry[.]com

This domain, mijn.belastingdienst.nl.kzxj5hqaf2c8scftx643rq72xggmaa86es9zjgs578tqm1drafbq.dentisttodentistry.com, was identified as a brand impersonation threat targeting the Dutch tax authority (Belastingdienst). Infrastructure analysis reveals the domain was registered on June 11, 2018, through GoDaddy.com, LLC, and was taken offline by the time of this assessment, returning an HTTP 503 status. The page title 'Mijn Belastingdienst' confirms the intent to mimic the legitimate Dutch government portal. Security vendors flagged the domain, with 16 of 93 detection engines on VirusTotal classifying it as malicious. It appears on one security blocklist and was blocked by PhishDestroy.

The domain resolved to IP 207.174.213.131, hosted on AS46606 (Unified Layer) in the United States, with nameservers ns1.parmproject.com and ns2.parmproject.com. An SSL certificate from Let's Encrypt (R12) was present, though this does not indicate legitimacy given the domain's fraudulent purpose. Defenders should note that while the domain is currently offline, its infrastructure remains registered and could be reactivated. The use of a subdomain under dentisttodentistry.com suggests an attempt to evade detection by leveraging a legitimate but compromised or misconfigured domain.

The Apache HTTP Server technology detected aligns with common phishing infrastructure but provides no unique attribution. No evidence of a specific phishing kit or further operational details is available at this time. Organizations are advised to monitor for reactivation, block the domain and associated IP at perimeter defenses, and review logs for prior connections from internal networks. The registration age and hosting provider are consistent with long-term abuse patterns, warranting continued vigilance.