entertainment media

adult content

corporate

Dutch

session_start_set

utag_main__sn

__Secure-next-auth.callback-url

utag_main__pn

_gcl_au

eupubconsent-v2

cX_P

_pubcid_cst

utag_main__se

utag_main_dc_event

utag_main_ses_id

_ga_27LLWVSXN9

OptanonConsent

nmo_fpid

_pubcid

_pcid

consent

euconsent

utag_main__st

__Host-next-auth.csrf-token

_pctx

cookieconsent_status

ck_page_id

_hjSession_3682737

utag_main_dc_visit

utag_main__ss

utag_main_dc_region

gdpr_consent

_hjSessionUser_3682737

utag_main_v_id

ck_page_category

session_pageview_count_net

OptanonAlertBoxClosed

cX_G

_fbp

You're looking at domain '538.nl' on the Dutch country-code top-level domain (.nl) and has no subdomain. The core label '538' covers 3 characters with 0 vowels and 0 consonants, notching 3 digits. Word splitting yields one word: 538. No strong language cues emerged from the frequency lists.

email

inline; filename="luisteraar-ontdekt-dat-de-inbreker-een-heel-bekende-bleek-te-zijn.webp"

inline; filename="Julia-s_omi_haalt_alles_uit_het_leven.webp"

inline; filename="new-tile-purple-538.webp"

inline; filename="radio538_marnix_westhuis_3x2_2400x1600.webp"

inline; filename="header-538-favourite-ella-langley-choosin-texas.webp"

inline; filename="dit-waren-aries-beste-moppen-van-de-maand-juli.webp"

inline; filename="Dit_zijn_de_meest_populaire_automerken_onder_-oude_bestuurders-.webp"

inline; filename="de-allerlaatste-week-in-oneliners-met-rob-scheepers.webp"

inline; filename="nederlander-karsten-jamt-met-teddy-swims-hij-gaf-me-zijn-nummer.webp"

inline; filename="1080x1920_nonstop.webp"

inline; filename="1080x1920_greatesthits.webp"

inline; filename="zender_90-s_tile_home.webp"

inline; filename="zender_ochtendshow_tile_home.webp"

inline; filename="538-Tomorrowland-1080x1920.webp"

__pb_locator__

_hjSafeContext

378dc7a82184584eb4c48e5c5380f6cd62a0a62b630c450c0b69a30d79358b07

76187e1cf3a80945d8bd89f371e839f638fb991a2dbc6abaa332ba801c4e2f84

b6046eae0a290ad258fbdc4c2d305554cb53572164663420e6eee645023dc084

fab073c8422af54fda5482d140f9f63fee3c2c9678d9a3a086c6cec74cc99c15

e0f24a52c5dbae5d77088f5c6c7259043dd452149c35d67ff8eb22ebe8d0e3ba

372ef7961e33e665444b69dc1fc1369bda1ade5375f15039d5e77626adc79256

68b5cfaa8ef001c6aa3bde795bf509b317113945c8a1c6361fde64ae8dad24af

9ffcb2271db90e98885eeff7c9cec7fa170f560ece68498de6b35eaa5cab30fc

06836b3976e56160a10851faacb8cc5b43eb2a52f371ed8d1f0765dc9d20507c

dc4bfdcb45a743f47dcd90cefa169912bca30d321b0c06d816aca7291da3a1eb

513cb8929f454f5d26b0a4f22326ac0ad613124eeec1061db9d54d6261048f25

aa4815688cd2d0da209bfebf483130996b53a768f561414d4ec83839f4c979ef

93aafb604a9fee9bb9ecebc59003e13b62561c76a143327bda28d394cede9a2d

6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

5a6c279c7a1dda91b22b6a4659297a3f096325e1bbe5cd6370fc34b22982cadd

b1cc5b22f16a622a2e12724b01d62cc6a975e7a939c2d8421207387b2e175900

8ab2cb6acdf604279ed28937b19a06814d48adf31a73c071c1f0d6198b91db8f

33696caa99cb8048be4d0ac061a2613d34a46e36b86084a3221f9f91ca87d844

6b8e30f25b0fb8148b81cf0d2b60e1b02599a7e0039b5de3943d0b50fee2edc1

a275f83a0937c6ef6b0d14920d74d9d849976329736ad0da82d43c734a2a19f6

68d800ad3e44f27e4ed81970e13577d6864458279989d87c3cea6ebf89f67cf4

4739d9d33ad634be5c1083ed2f5abb065a1666bef67457a02e0b9a943c1601bf

ec95e65156a693e7e00e8032e72fed3c7621c731f312401e6f5a9cb03a8c6553

55c61e7e7fd15252ed19f2a8f5125174a76c08b42f3a655dc1d040b55462f5f6

bda224884e6f7cc678d9758c2e6e7bc16ce9f75e78c7b04e782baab1ba22a18c

ac0e96e754d07a921cc2b2eb888c0453a1107c42e71ee9c61ffdffdc966afd37

ad9f757233cbf6d577232e08cf6f4452c26a1e962415ad4866474c752865d5ac

5ba9edfbed95cdc379b60171dbd42ad1744c36596c6b9531ef1ba939639f361a

1ad2c878573d575e155c92f2d4d3b71484a0c551749822b496d39d96ccf5c3c4

5812ece79bb9e15ad9d75fae937019c762777e30f8b6ee1d43c591d5d86dda1a

4d9e6a332542f4178bb5858727657feee5eb7804aed0c358863425fa3a065a47

a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

e4926427777f13d8a765d0367863147c6240a3c80530d0fead7dd44cf3472bea

f94d108b260ed1245d9a8aac1adcc5f4efacc769cfc210c59d56007fc194289e

fb3a7ab84f88fece7a0cf72fc18e93f4e718c6405355e7d7945727ff239b62f0

07bb1ed00cbcfa67478f6808fe099bef656442e3ed6a1292d0db2a4fd612afe0

05cb883afdabb39b18d134c59bd2da4ca673cfcecf4eee78c510340112189b67

79726888143f4e87b4e11d12e50e33525fc8f58ef15b59bbb1e7c62624df3c67

307a7647705db81b11bbb4cbb41dc8790caba9dd00205e52172589ce63c0ad62

7b21bbb8ef971401ae80a3877b20405f18623e70111a65f0503458ea623255ce

eafa29f462263130151c9e4351f6e7515e9ab891cf6fd8ac715121e14eab7274

18120a6bee05cd823d5f4ab0c52006863a059a5d6c535c790a31bdd2ee8c45e7

a96aa5e0f478c42c7ec9b3efe54932648aefe298e80d088b63fd9a46ea78c71b

3bb1920d80aa5e8342848c5c5d8cedce667e146af682107badfb33139f55f699

1326dd99dc85c57b26495efd2dfcee6d0db1ff1a16f6f96dc162a6c497cfc043

e9fb36191cd4168c2f7a81daf08358a5cbc2785e81bb391a2180c035f59ed94e

c1f7d0a19c0e6f106d06233f5efdede80451bae9c1f21147c651c76b799c849e

6af6f45bd2914eed332c0682aa64a16612a0da07222aadc8befc5df2b49f2931

3210770901bcc8e54598b1efc92d7a9c81a028eaf42925a8420832ae65316810

e6818637e5fa28d556f2906d448b71bd1a40acab15556a615612cd6ec647c627

default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-YVrSFbHH';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

bb610c982aec61b412af1972e647249ebda0eaf2ec4d5d74fe980a7b363fdf97

f274a4e66f9477062ff89db5db555324d31998350a7db9c28da1713c9686218c

default-src *.facebook.com *.fbcdn.net *.facebook.net 'self' blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net blob: 'self' 'nonce-INAJzYpT';style-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob: 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com *.cdninstagram.com blob: 'self' data: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net;font-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;img-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;media-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;child-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;frame-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;manifest-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;object-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;worker-src *.facebook.com *.fbcdn.net *.facebook.net 'self' data: blob:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;

cdb8f3e80eaca2ecdac42c288ed3d4d8337979635396cb262224212c1ed34843

6a61951dc1e170fa4599a7cc9a729c8e36e8f2eab5c55a08dc2bcdbd2faa2609

a36fd7417f7bc17bbd92be4d99a4da556f571f719eda382670bd745132e164eb

d1ecddd282545680b0eec0f427cb7680fe9757ec82f1d7125cb06cc60e26d6bf

2991c7be5a06a48c0fa3eaa34816252edc6ff1353408420c264516e6d71ae09b

Next.js missing cache-control header may lead to CDN caching empty reply

Next.js Denial of Service (DoS) condition

Next.js Vulnerable to HTTP Request Smuggling

Next.js Allows a Denial of Service (DoS) with Server Actions

Authorization Bypass in Next.js Middleware

Next.js Server-Side Request Forgery in Server Actions

Denial of Service condition in Next.js image optimization

Next.js authorization bypass vulnerability

Next.js Race Condition to Cache Poisoning

Information exposure in Next.js dev server due to lack of origin verification

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

It was found that the fix addressing [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).

A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

eff04ac3433d0b91486abbde8656932f145852b41f49b69f57361804e4ef11a4

f5cc8b5ecdc5a7313b447ebda8d969042f0ac366c82adc60f2785258cfab602a

c444c32a0a8dcace275a27defacf5773a8d507d1e9f388803699d70f3bfd785e

2dbca436f9286e8daacd7923bbdd71cd8bfe90cc1e6db9f96d4b5c846a7b1581

386d842faf82de80f38e352211a757e5f2039f803037e3e285aefc4694192b27

fa2c5169f76fd7f31dafbfd447649b870caf8831ec7aad434c2d0792dea04ecc

3c0072884a63df90fc71b6bd857d30d2a0065238a7269c9d8a837599686e9aad

WIN WEEKENDTICKETS VOOR DE FORMULA 1 HEINEKEN DUTCH GRAND PRIX! 🏁🧡

LUISTERAAR ONTDEKT DAT DE ‘INBREKER’ EEN HEEL BEKENDE BLEEK TE ZIJN... 😱

JULIA'S OMI HAALT ALLES UIT HET LEVEN! 💃🍷

viewport

https://cldnr.prod.webx.talpa.digital/talpa-network/image/fetch/w_1200,h_630,c_fill,q_auto,f_webp/https://images.ctfassets.net/3p0bn61n86ty/4yGfbGM6aliQGpl1of1Alg/f2ec8519aa509b1b5f90442775d42c58/METAfoto_2026_ochtendshow_middagshow_radio538.jpg

https://cldnr.prod.webx.talpa.digital/talpa-network/image/fetch/w_1200,h_627,c_fill,q_auto,f_webp/https://images.ctfassets.net/3p0bn61n86ty/4yGfbGM6aliQGpl1of1Alg/f2ec8519aa509b1b5f90442775d42c58/METAfoto_2026_ochtendshow_middagshow_radio538.jpg

Jouw hits, jouw 538! Luister en kijk live, check de programmering en ontdek de leukste radiofragmenten. Mis niks van jouw favoriete shows en dj's.

description

next-head-count

emotion-insertion-point

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

abuse@registrar.eu

REDACTED FOR PRIVACY

Registrar.eu

538.nl

Amazon Web Services, LLC

Amazon

A100 ROW GmbH

Amazon Webservices EC2

AMAZO-ZFRA

Radio 538

www.538.nl

  Conviva Video Monitoring

Display Ads SDK

countryCode

Video Geo Restriction Outside NL

Delay Player Until Hashed Visitor ID

Kingsday 538 player theme

Talpa Auth

Contact Studio (Radio 538)

ENABLED - Article Author

Table Filter

Restart playback on fatal errors

App Smart banner (Radio 538)

Radio 538 | A-B test Station Autoplay on station tiles (1)

Pulsating Play Button Radio 538

ENABLED - WebX player Pause Ad

ENABLED - Ad Free for Talpa Network logins

currentPath

userId

Track Chat

Radio 538 Companion

Track Previews for Radio playlists

Subscription Legal Text

Meld je aan voor onze wekelijkse nieuwsbrief met daarin het laatste nieuws en aanbiedingen die wijzelf of in samenwerking met onze partners organiseren. Je kunt je op ieder moment afmelden. Zie voor meer informatie de <a href="https://privacy.talpanetwork.com/nl/privacy" target="_blank">privacyverklaring</a>.

Player AdBlock detection

Adobe Delay

  Conviva PoC

Download de Radio 538 App

var(--neutral-100-color)

var(--font-header-4)

var(--font-header-3)

pill

normal normal 12px/15px QanelasSoft, Sans-Serif

600 normal 12px/15px QanelasSoft, Sans-Serif

normal normal 18px/26px QanelasSoft, Sans-Serif

600 normal 18px/26px QanelasSoft, Sans-Serif

normal normal 16px/24px QanelasSoft, Sans-Serif

italic normal 16px/24px QanelasSoft, Sans-Serif

600 normal 16px/24px QanelasSoft, Sans-Serif

normal normal 14px/20px QanelasSoft, Sans-Serif

600 normal 14px/20px QanelasSoft, Sans-Serif

Requests	IP Address	Location	AS Autonomous System
30	18.245.86.68Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
30	146.75.122.114Fastly · CDN	Frankfurt am Main, Hesse, Germany	AS54113Fastly, Inc.
30	18.245.86.79Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
30	104.18.86.42Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
30	3.160.150.22Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
150	5	-	-

Security Scan Report: 538.nl

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Page Statistics

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History