Indicator ntcode.xyz Type domain Category SEO Poisoning Confidence high VT Score 0/94 (pending) Source urlscan First Seen 2026-10-11 16:00:19 UTC Last Seen 2026-10-11 16:00:19 UTC urlscan View scan result ↗
Raw JSON
{
  "verdicts": {
    "score": 0,
    "malicious": false,
    "urlscan": {
      "malicious": false
    },
    "engines": {
      "score": 59,
      "malicious": true,
      "hasVerdicts": true,
      "tags": [
        "urlscan-ml",
        "urlscan-ml-60c5e22"
      ]
    },
    "community": {
      "score": 0,
      "malicious": false,
      "hasVerdicts": false
    }
  },
  "submitter": {
    "country": "it"
  },
  "frames": {
    "length": 1
  },
  "canonical": {
    "task": {
      "url": "ntcode.xyz/Download/setup.exe"
    },
    "page": {
      "url": "ntcode.xyz/Download/setup.exe"
    }
  },
  "clipboard": {
    "length": 0
  },
  "labels": [
    "domain.apexdomain"
  ],
  "task": {
    "visibility": "public",
    "method": "api",
    "domain": "ntcode.xyz",
    "apexDomain": "ntcode.xyz",
    "time": "2026-10-11T10:56:48.924Z",
    "uuid": "01a12a9b-3415-7223-89d3-28ab131a7421",
    "url": "https://ntcode.xyz/Download/setup.exe",
    "tags": [
      "@ecarlesi",
      "possiblethreat"
    ]
  },
  "stats": {
    "uniqIPs": 1,
    "uniqCountries": 1,
    "dataLength": 0,
    "encodedDataLength": 0,
    "requests": 1
  },
  "meta": [],
  "scanner": {
    "country": "dk"
  },
  "files": [
    {
      "filename": "setup.exe",
      "sha256": "feeba2b3ab9501d26b206df049aef8883919c4a29fa2a78e940409ffb41ef877",
      "filesize": 44643430,
      "state": "completed",
      "mimeType": "application/x-dosexec",
      "mimeDescription": "PE32+ executable (GUI) x86-64, for MS Windows",
      "url": "https://ntcode.xyz/Download/setup.exe"
    }
  ],
  "links": {
    "length": 0
  },
  "page": {
    "country": "US",
    "server": "Netlify",
    "ip": "98.84.224.111",
    "apexDomainAgeDays": 0,
    "mimeType": "application/x-dosexec",
    "url": "https://ntcode.xyz/Download/setup.exe",
    "tlsValidDays": 89,
    "tlsAgeDays": 0,
    "ptr": "ec2-98-84-224-111.compute-1.amazonaws.com",
    "domainAgeDays": 0,
    "tlsValidFrom": "2026-10-10T21:55:28.000Z",
    "domain": "ntcode.xyz",
    "apexDomain": "ntcode.xyz",
    "asnname": "AMAZON-AES - Amazon.com, Inc., US",
    "asn": "AS14618",
    "tlsIssuer": "YE1",
    "status": "200"
  },
  "websockets": {
    "totalBytesSent": 0,
    "totalBytesReceived": 0,
    "length": 0
  },
  "_id": "01a12a9b-3415-7223-89d3-28ab131a7421",
  "_score": null,
  "sort": [
    1791716208924,
    "01a12a9b-3415-7223-89d3-28ab131a7421"
  ],
  "result": "https://urlscan.io/api/v1/result/01a12a9b-3415-7223-89d3-28ab131a7421/",
  "screenshot": "https://urlscan.io/screenshots/01a12a9b-3415-7223-89d3-28ab131a7421.png"
}

Campaign cluster — 90 pivot-discovered domains

Domain VT Score
www.juwelier-roller.de 0/94
rainbow-creponne-c355e3.netlify.app 0/94
jennywatling.co.uk 0/94
andrewmaitacoaching.org 0/94
midwaygeneralstore.com 0/94
www.maddogsflagfootball.com 0/94
6ac64dea6359e0000829f6b4--synclaro-unified.netlify.app 0/94
embed-6aca5e796b3127af16893158--splendorous-sable-ba788d.netlify.app 0/94
holmfirthnyc.tcatours.co.uk 0/94
inventarc-ip-help.com 0/94
glittering-donut-e178a4.netlify.app 0/94
bmwstyle37wheels.netlify.app 0/94
nexzan-com.netlify.app 0/94
leadclimbermarketing.com 0/94
isabellatuana.netlify.app 0/94
frostreasurymembers.netlify.app 0/94
vetrod.com 0/94
crypto-aoe.netlify.app 0/94
horizonnationalbank.net 0/94
www.novascotialegalresource.ca 0/94
swingnshootapparel.co 0/94
jpadministracionesco.com 0/94
horsetrickrecipe.netlify.app 0/94
latelier-du-boucher.blackflag.paris 0/94
emiringotdeligi.com 0/94
webmailrubiconfounders.netlify.app 0/94
room-secure.vacations 0/94
foxwave108.netlify.app 0/94
dlt-travel.netlify.app 0/94
admin.readpraysing.com 0/94
venerable-froyo-5171ba.netlify.app 0/94
www.telfs.ca 0/94
scotiarecovery-server.com 0/94
validatesimplicitycu.netlify.app 0/94
lexrefund.top 0/94
nixieai.vortexcore.app 0/94
secondpost.netlify.app 0/94
dufies.netlify.app 0/94
pembatalanpinjamanpaylaterdana-netl.netlify.app 0/94
mdgdenman.ca 0/94
boisterous-medovik-8ff03b.netlify.app 0/94
brainrotawareness.site 0/94
deploy-preview-7--iacs-staff-start.netlify.app 0/94
deploy-preview-8--iacs-staff-start.netlify.app 0/94
6a21b8677c9e9d000836c869--iacs-staff-start.netlify.app 0/94
6a21b633da072400087c2e5c--iacs-staff-start.netlify.app 0/94
6a21ba42c8947c00084e8630--iacs-staff-start.netlify.app 0/94
6a21b3cd21bd6b0008f2244b--iacs-staff-start.netlify.app 0/94
6a10749e6a674d0009d5dfe3--iacs-staff-start.netlify.app 0/94
6a1f12282f29420008f068ef--iacs-staff-start.netlify.app 0/94
6a107acc1c2c4a0008dfd95c--iacs-staff-start.netlify.app 0/94
shinkaiko.netlify.app 0/94
laemcasamudou.netlify.app 0/94
discoverygem.dev 0/94
www.soulmadebranding.co.za 0/94
lakepointe-towers-preview.netlify.app 0/94
spiresportfolio.com 0/94
flagstoneitsolutions.ca 0/94
spiffy-snickerdoodle-d7067b.netlify.app 0/94
foxtros.com 0/94
beautiful-bonbon-232955.netlify.app 0/94
frenosysuspensionperea.com 0/94
caidjt2conme2chungmay2.netlify.app 0/94
throttle-hr.com 0/94
foxbus.netlify.app 0/94
crypto-1co.netlify.app 0/94
sfhelp-tech-support-san-francisco.top 0/94
mybulo4ka.netlify.app 0/94
nav.365c.online 0/94
bcbsm-landing-dev.netlify.com 0/94
fedx-logistics.netlify.app 0/94
mytomoe.casa 0/94
scotiabooknow.com 0/94
fedex-pdfonline-viewers-362.netlify.app 0/94
bleach-cal.netlify.app 0/94
mineparis.com 0/94
cateringpro.my 0/94
foxhealthy483.netlify.app 0/94
abcdwendt.com 0/94
6acb30a38528b353708988e9--marvelous-blancmange-19c3b9.netlify.app 0/94
6a8c8c2f153dc500085c6eb6--iacs-staff-start.netlify.app 0/94
6a21bb6b64449f00086e04fe--iacs-staff-start.netlify.app 0/94
vermillion-cupcake-5078de.netlify.app 0/94
tranquil-starlight-3ff243.netlify.app 0/94
www.connomation.ca 0/94
workspaceultimate.netlify.app 0/94
velvety-starship-656d56.netlify.app 0/94
test--archanaram.netlify.app 0/94
nordictenors.no 0/94
sabiwallet.online 0/94