Indicator serv123.xyz Type domain Category SEO Poisoning Confidence high VT Score 3/94 Source urlscan First Seen 2026-05-13 00:00:02 UTC Last Seen 2026-05-14 00:00:50 UTC urlscan View scan result ↗
Raw JSON
{
  "verdicts": {
    "score": 0,
    "malicious": false,
    "urlscan": {
      "malicious": false
    },
    "engines": {
      "score": 97,
      "malicious": true,
      "hasVerdicts": true,
      "tags": [
        "urlscan-ml",
        "urlscan-ml-60c5e22"
      ]
    }
  },
  "submitter": {
    "country": "it"
  },
  "frames": {
    "length": 1
  },
  "usertags": [],
  "canonical": {
    "task": {
      "url": "serv123.xyz/UltraViewer.exe"
    },
    "page": {
      "url": "serv123.xyz/UltraViewer.exe"
    }
  },
  "task": {
    "visibility": "public",
    "method": "api",
    "domain": "serv123.xyz",
    "apexDomain": "serv123.xyz",
    "time": "2026-05-12T18:11:38.449Z",
    "uuid": "019e1d62-aeeb-735c-81f8-a5e190656702",
    "url": "http://serv123.xyz/UltraViewer.exe",
    "tags": [
      "@ecarlesi",
      "possiblethreat"
    ]
  },
  "stats": {
    "uniqIPs": 1,
    "uniqCountries": 1,
    "dataLength": 0,
    "encodedDataLength": 0,
    "requests": 1
  },
  "meta": [],
  "scanner": {
    "country": "at"
  },
  "files": [
    {
      "filename": "UltraViewer.exe",
      "sha256": "020aac79a14717e316a593155ca778dd3e253b888bf62633b174838d35df7f41",
      "filesize": 3648408,
      "state": "completed",
      "mimeType": "application/x-dosexec",
      "mimeDescription": "PE32 executable (GUI) Intel 80386, for MS Windows",
      "url": "https://serv123.xyz/UltraViewer.exe"
    }
  ],
  "links": {
    "length": 0
  },
  "page": {
    "country": "DE",
    "server": "LiteSpeed",
    "redirected": "https-only",
    "ip": "159.100.6.19",
    "apexDomainAgeDays": 0,
    "mimeType": "application/x-msdownload",
    "url": "https://serv123.xyz/UltraViewer.exe",
    "tlsValidDays": 89,
    "tlsAgeDays": 0,
    "domainAgeDays": 0,
    "tlsValidFrom": "2026-05-12T11:34:15.000Z",
    "domain": "serv123.xyz",
    "apexDomain": "serv123.xyz",
    "asnname": "ULTAHOST-AS Ultahost, Inc., US",
    "asn": "AS214036",
    "tlsIssuer": "R12",
    "status": "200"
  },
  "websockets": {
    "totalBytesSent": 0,
    "totalBytesReceived": 0,
    "length": 0
  },
  "_id": "019e1d62-aeeb-735c-81f8-a5e190656702",
  "_score": null,
  "sort": [
    1778609498449,
    "019e1d62-aeeb-735c-81f8-a5e190656702"
  ],
  "result": "https://urlscan.io/api/v1/result/019e1d62-aeeb-735c-81f8-a5e190656702/",
  "screenshot": "https://urlscan.io/screenshots/019e1d62-aeeb-735c-81f8-a5e190656702.png"
}

Campaign cluster — 65 pivot-discovered domains

Domain VT Score
www.media.hotelbhawnapalace.com 0/94
media.hotelbhawnapalace.com 0/94
voicepagere.com 0/94
cpcontacts.credencecaptalbk.online 0/94
webmail.ferdinandoriversano.com 0/94
mail.ferdinandoriversano.com 0/94
webdisk.credencecaptalbk.online 0/94
credencecaptalbk.online 2/94
www.credencecaptalbk.online 0/94
webdisk.ferdinandoriversano.com 0/94
aurumtrustbnk.com 2/94
cpanel.ferdinandoriversano.com 0/94
webmail.credencecaptalbk.online 0/94
mail.credencecaptalbk.online 0/94
cpcontacts.ferdinandoriversano.com 0/94
cpcalendars.aurumtrustbnk.com 0/94
devishtdz.xyz 11/94
a2xcreative.com 1/94
apexfutureswealth.com 20/94
askg29g-ad.online 3/94
mail.serv123.xyz 2/94
gova-sa-e.net 0/94
salik-ae.net 1/94
xyzevaluate.site 0/94
naql-logistl.net 0/94
zoomfaucet.com.imalamin.com 1/94
www.zoomfaucet.com.imalamin.com 1/94
fundsinquirydeptgov.com 1/94
maxfundgovsg.com 12/94
maxpriorityfundgovsg.com 10/94
fundsinquiry.com 2/94
unioncrownassets.com 17/94
allusere.icu 2/94
maxpriorityfd.com 0/94
bnbchainhub.com 2/94
armamentcaptal.online 0/94
whm.gurneysgardens.com 0/94
serversecureptt.com 0/94
webmail.serversecureptt.com 0/94
cpcalendars.serversecureptt.com 0/94
webdisk.serversecureptt.com 0/94
www.serversecureptt.com 0/94
mail.serversecureptt.com 0/94
cpanel.serversecureptt.com 0/94
cpcontacts.serversecureptt.com 0/94
new6hosting.net 5/94
crownparcel.com 2/94
govptt.com 1/94
cpcalendars.govptt.com 0/94
mail.govptt.com 0/94
webdisk.govptt.com 0/94
webmail.govptt.com 0/94
cpcontacts.govptt.com 0/94
www.govptt.com 0/94
cpanel.govptt.com 0/94
hackerbul.com 0/94
cpanel.credencecaptalbk.online 0/94
fundsinquirydeptgovsg.com 0/94
cpcalendars.credencecaptalbk.online 0/94
www.ferdinandoriversano.com 2/94
halalethics.net 4/94
kdakadkjklaass.com 0/94
vuxirowhj.com 13/94
ferdinandoriversano.com 2/94
cpcalendars.ferdinandoriversano.com 0/94