mijn[.]belastingdienst[.]nl[.]kwrfnsnqeeqxafzdr7hbjly8gd99g3yrjqqmtsaxqqtxzeo6f2a9[.]aizman[.]com[.]br

The domain mijn.belastingdienst.nl.kwrfnsnqeeqxafzdr7hbjly8gd99g3yrjqqmtsaxqqtxzeo6f2a9.aizman.com.br was flagged as an elevated‑risk brand‑impersonation campaign targeting the cryptocurrency exchange Bybit. The site’s page title, "Mijn Belastingdienst," suggests an attempt to masquerade as a Dutch tax authority, yet the intelligence explicitly classifies the threat as a Bybit impersonation, indicating a mismatch between visible branding and the intended victim set. Technical observations reveal that the domain resolves to IP address 187.110.161.85, which belongs to ASN 53107 (EVEO S.A.) located in Brazil. The hosting provider therefore resides outside the primary target geography, a pattern common in malicious infrastructure. The domain registration date is 2 June 2006, implying that the name may have been repurposed after long‑term dormancy, a tactic used to leverage existing DNS reputation.

No SSL certificate is present, meaning the site operates over plain HTTP, simplifying detection by network‑level filters. The Gridinsoft trust score of 0 out of 100 marks the domain as extremely untrustworthy. It appears on a single security blocklist and has been actively blocked by PhishDestroy, demonstrating that at least one dedicated anti‑phishing service has taken remediation steps. VirusTotal analysis shows three of ninety‑five scanners flagged the domain, providing additional confirmation of malicious intent.

Nameserver information is unavailable (NS_NOT_FOUND), limiting the ability to trace authoritative records. Current status is offline, indicating the site has been taken down or is no longer serving content. Defenders should continue to block the full domain string and any sub‑domains derived from the observed pattern, monitor the associated IP range and ASN for related activity, and update host‑based or DNS‑based filtering solutions with the observed indicators.