# PhishDestroy domain threat record: adminvisibilidad.serviciosmsm.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/adminvisibilidad.serviciosmsm.com/
Machine-readable companion: https://phishdestroy.io/domain/adminvisibilidad.serviciosmsm.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 12:15:30 UTC
- Last availability or vendor check: 2026-10-22 10:25:51 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: microsoft

## Stored infrastructure

- Observed IP address: 82.98.171.242
- Registrar in stored WHOIS data: 10dencehispahard SLU
- Last stored HTTP status: 200
- Registration date (registry RDAP, serviciosmsm.com): 2024-05-21 14:00:08 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a11fff-9592-7336-ac07-d3997837e4e5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/adminvisibilidad.serviciosmsm.com
- Certificate Transparency search: https://crt.sh/?q=%25.adminvisibilidad.serviciosmsm.com
- Web Archive lookup: https://web.archive.org/web/*/https://adminvisibilidad.serviciosmsm.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
adminvisibilidad.serviciosmsm.com is an impersonation phishing page sitting on a subdomain whose Spanish name roughly reads as "visibility admin" under a generic "services" domain. It is built to pass as a trusted service and capture what visitors type into it. PhishDestroy first flagged it on 2026-10-11. It was still online and serving content when last checked on 2026-10-19.

How the scam works
The page carries only the bare title "App", with no brand name in the browser tab. We classify it as impersonation because the site is presented as a legitimate service it has no connection to. Pages like this usually arrive through a link in an email, message or ad. The link points to a lookalike login or account screen that asks for credentials, verification codes or personal details. Anything submitted goes straight to the operators, who can then take over the real account or reuse the data for further fraud.

Evidence
When VirusTotal scanned the domain on 2026-10-12, 15 of 92 engines marked it as malicious. The flagging vendors include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, CRDF and CyRadar. Agreement among that many independent, unrelated vendors makes a false positive unlikely, although most engines had not yet caught up at scan time. Among blocklists, it currently appears on PhishDestroy's.

Infrastructure
The parent domain was registered on 2024-05-21 through 10dencehispahard SLU, almost two and a half years before the phishing subdomain came to our attention. The site resolves to 82.98.171.242 on DinaHosting S.L. in Spain, a Spanish registrar and host pairing that suits a Spanish-language lure. Its Let's Encrypt certificate means the browser shows a padlock. That padlock confirms only an encrypted connection, not that the site is legitimate.

What to do
If you entered a password on this page, change it right away on the genuine service and on every other account that shares it. Then turn on app-based two-factor authentication and sign out of all active sessions. If you typed in a one-time code, check the real account for changed recovery emails, new devices or unfamiliar activity. If you shared card or identity details, alert your bank and watch for follow-up messages pretending to come from the impersonated service. Defenders should block the full hostname and its IP at the mail and web gateway, and search logs for users who clicked through after 2026-10-11.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11fff-9592-7336-ac07-d3997837e4e5/
VirusTotal report: https://www.virustotal.com/gui/domain/adminvisibilidad.serviciosmsm.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=adminvisibilidad.serviciosmsm.com
Archived copy: https://web.archive.org/web/20261011121819/https://adminvisibilidad.serviciosmsm.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:38 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a11fff-9592-7336-ac07-d3997837e4e5.png
  Captured: 2026-10-11 12:15:30 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a11fff-9592-7336-ac07-d3997837e4e5.png
  Source report: https://urlscan.io/result/01a11fff-9592-7336-ac07-d3997837e4e5/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f1956c5e-4c8b-453d-91ff-704a417aae60.png
  Captured: 2026-10-12 09:39:26 UTC
  Source report: https://radar.cloudflare.com/scan/f1956c5e-4c8b-453d-91ff-704a417aae60
  SHA-256: c2eea4f9f0c5fa224c86dd839808255acd736acd53afa7bc652fcf918a594d25
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d616-5add-713a-aab8-6e954db419f0.png
  Captured: 2026-09-25 01:03:12 UTC
  Source report: https://urlscan.io/result/01a0d616-5add-713a-aab8-6e954db419f0/
  SHA-256: cf2e3b5faf8a92480ef1c950b6f88fc50c97d2c64e6c0940089b3d345c2984c3
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d848-a4a2-7291-94d6-d08cf6eb7040.png
  Captured: 2026-09-25 11:17:30 UTC
  Source report: https://urlscan.io/result/01a0d848-a4a2-7291-94d6-d08cf6eb7040/
  SHA-256: cf2e3b5faf8a92480ef1c950b6f88fc50c97d2c64e6c0940089b3d345c2984c3
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0de05-df76-7516-b906-5c92ef579139.png
  Captured: 2026-09-26 14:02:13 UTC
  Source report: https://urlscan.io/result/01a0de05-df76-7516-b906-5c92ef579139/
  SHA-256: cf2e3b5faf8a92480ef1c950b6f88fc50c97d2c64e6c0940089b3d345c2984c3
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ae5-696b-7360-8cc8-4b7fea036ceb.png
  Captured: 2026-10-11 12:17:32 UTC
  Source report: https://urlscan.io/result/01a12ae5-696b-7360-8cc8-4b7fea036ceb/
  SHA-256: 01e506b6b356d5680f03b53489504fe595da075279a7cc5bdc020b1420bdd5ea
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ae8-5578-756a-9df7-b531c2833634.png
  Captured: 2026-10-11 12:20:39 UTC
  Source report: https://urlscan.io/result/01a12ae8-5578-756a-9df7-b531c2833634/
  SHA-256: 01e506b6b356d5680f03b53489504fe595da075279a7cc5bdc020b1420bdd5ea
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a139d9-4952-714c-b7ac-fc2b1950f9a2.png
  Captured: 2026-10-14 09:58:31 UTC
  Source report: https://urlscan.io/result/01a139d9-4952-714c-b7ac-fc2b1950f9a2/
  SHA-256: 01e506b6b356d5680f03b53489504fe595da075279a7cc5bdc020b1420bdd5ea

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:54Z",
        "uuid": "01a11fff-9592-7336-ac07-d3997837e4e5",
        "scanned_at": "2026-10-09T09:30:13Z",
        "final_url": "https://adminvisibilidad.serviciosmsm.com/",
        "status": 200,
        "ip": "82.98.171.242",
        "ptr": "hl1510.dinaserver.com",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "2a00:1450:4001:c25::5f",
            "82.98.171.242"
        ],
        "asns": [
            "15169",
            "42612"
        ],
        "countries": [
            "US",
            "DE",
            "ES"
        ],
        "doc_hash": "cddce8b350f1e32e1759587b63f1b1373c1142ef284dae97ead65aec5dcd6c60",
        "script_hashes": [
            "969834dbff393733057e5d25197c4e0097fd43d19c37b0dc4d07ce9c434c1643"
        ],
        "globals": [
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "uidEvent",
            "__VUE__"
        ],
        "tls": {
            "san": [
                "admindossier.serviciosmsm.com",
                "adminferiamalaga.serviciosmsm.com",
                "admintotemmsm.serviciosmsm.com",
                "adminvisibilidad.serviciosmsm.com",
                "alargatuverano.serviciosmsm.com",
                "baseslegales.serviciosmsm.com",
                "beerflights.serviciosmsm.com",
                "common.serviciosmsm.com",
                "dossier.serviciosmsm.com",
                "dossiersalaseventos.serviciosmsm.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "serviciosmsm.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-23T13:13:22Z",
            "valid_from": "2026-09-24T13:13:23Z"
        },
        "domain_age_days": 400,
        "apex_age_days": 1332,
        "tls_age_days": 14,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 8,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "HTTPd",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:32Z",
        "uuid": "f1956c5e-4c8b-453d-91ff-704a417aae60",
        "scanned_at": "2026-10-12T09:39:26Z",
        "final_url": "https://adminvisibilidad.serviciosmsm.com/",
        "status": 200,
        "history": [
            {
                "url": "https://adminvisibilidad.serviciosmsm.com/",
                "status": 200
            }
        ],
        "dom_hash": "0f1a1847a91d7f383a9d20e15085a2d55448ed37c17d5b306997b3941c3e2add",
        "doc_hash": "cddce8b350f1e32e1759587b63f1b1373c1142ef284dae97ead65aec5dcd6c60",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "adminvisibilidad.serviciosmsm.com",
                "type": "A",
                "value": "82.98.171.242"
            }
        ],
        "dnssec_valid": false,
        "ip": "82.98.171.242",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "10dencehispahard SLU",
            "created": "2024-05-21T14:00:08Z",
            "updated": "2026-04-24T08:10:24Z",
            "expires": "2027-05-21T14:00:08Z",
            "nameservers": [
                "ns.gestiondecuenta.com",
                "ns2.gestiondecuenta.com",
                "ns3.gestiondecuenta.com",
                "ns4.gestiondecuenta.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:33Z",
        "analysis_at": "2026-10-20T17:19:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 13,
            "suspicious": 1,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "10DENCEHISPAHARD, S.L",
        "created": "2024-05-21T14:00:08Z",
        "expires": "2027-05-21T14:00:08Z",
        "updated": "2026-04-24T08:10:24Z",
        "first_seen": "2025-09-04T06:27:40Z",
        "dns": [
            {
                "ttl": 300,
                "type": "TXT",
                "value": "crdf-verify-959c36563fa09808"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "82.98.171.242"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "gridinsoft-verify=vck5pf0dk52lknetnyahkfk0ybom3wfkhme15pqmzckp8bq7p8m7sylnfgfvxdyg"
            }
        ],
        "dns_at": "2026-10-20T17:23:26Z",
        "jarm": "2ad2ad16d2ad2ad00042d42d0000005fd00fabd213a5ac89229012f70afd5c",
        "cert": {
            "san": [
                "admindossier.serviciosmsm.com",
                "adminferiamalaga.serviciosmsm.com",
                "admintotemmsm.serviciosmsm.com",
                "adminvisibilidad.serviciosmsm.com",
                "alargatuverano.serviciosmsm.com",
                "baseslegales.serviciosmsm.com",
                "beerflights.serviciosmsm.com",
                "common.serviciosmsm.com",
                "concursosmlow.serviciosmsm.com",
                "dossier.serviciosmsm.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "60d8485b8587408c754ab4ac98850cf6416",
            "sha256": "3337d90f88872056628ab067f344e23e790defc2362a251a5f192aec490d68b5",
            "subject": "serviciosmsm.com",
            "valid_to": "2027-01-18T14:22:34Z",
            "valid_from": "2026-10-20T14:22:35Z"
        },
        "whois": {
            "registrar": "10DENCEHISPAHARD, S.L",
            "registrar_iana_id": "1403",
            "registrar_url": "https://www.cdmon.com",
            "created": "2024-05-21T14:00:08Z",
            "updated": "2024-05-21T16:00:08Z",
            "expires": "2027-05-21T14:00:08Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "ns.gestiondecuenta.com",
                "ns2.gestiondecuenta.com",
                "ns3.gestiondecuenta.com",
                "ns4.gestiondecuenta.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```