amendes24[.]serv00[.]net

Analysis indicates that amendes24.serv00.net was registered on February 21, 2026 through OVH sas and currently resolves to IP address 128.204.223.111 located in Poland. The domain employs nameservers dns1.serv00.com and dns2.serv00.com along with mail exchanger mail10.serv00.com. It serves content via Nginx and presents a 403 status code with the title Serv00.com - Free Website Hosting - 403 Website blocked. The SSL certificate is issued by Let's Encrypt under authority E8. Infrastructure records show the domain remains active as of July 12, 2026 and is classified under account takeover operations.

Intelligence sources record eight out of ninety-five security vendors marking the domain and note its presence on one blocklist. The page returns an explicit block response consistent with prior flagging actions. Registration age of roughly four months aligns with patterns seen in similar campaigns while the hosting arrangement on shared free infrastructure supports rapid domain rotation. MX configuration points to the same provider network used for the primary resolution.

Uncertainties remain around the exact payload delivery mechanism because the 403 response prevents direct content inspection. No additional files or redirects are observable from current records. The account takeover label stems from the reported threat classification rather than observed credential forms or login mimicry.

Defenders should add the domain and its resolving IP to internal block lists while monitoring for related subdomains or MX traffic. Review of mail logs for references to mail10.serv00.com can surface potential follow-on attempts. Continued observation of the 128.204.223.111 address for other hosted domains provides early indication of infrastructure reuse.