Scan report · about 2 months agoPublic

tecnicoepc.com

192.232.219.67AS31898 · US

Submittedhttps://tecnicoepc.com/ok/

Landed onhttps://tecnicoepc.com/ok/Windows/invite.php· 1 redirect

Suspicious: page delivers an executable (https://files-accl.zoho…DSupport%22%3Afalse%7D)

delivers a script, not an installer ("Zoomworkspace.bat")

Engine tags

Verdict

2 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 10.9 s · 7 requests

01 · Visitor openstecnicoepc.com/ok/

02 · Redirected · 1 hopSame host, another address/ok/Windows/invite.php

03 · Page shown

Zoom Client Updatestyled as Zoom · low

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be Zoom, which this address is not associated with. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingPage delivers an executable under a document pretext

https://files-accl.zohoexternal.com/public/workdrive-external/download/7rxexac66af3a695f48f38625c677bac32258?x-cli-msg=%7B%22linkId%22%3A%224P7pLySmX9v-114qDl%22%2C%22isFileOwner%22%3Afalse%2C%22version%22%3A%221.0%22%2C%22isWDSupport%22%3Afalse%7D · delivers a script, not an installer ("Zoomworkspace.bat")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

Zoom · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

File

The file was not analysed, so the scan carries no verdict on the file itself.

Infrastructure

IP: 192.232.219.67ORACLE-BMC-31898 - Oracle Corporation, US · AS31898US
TLS: CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB · expires Oct 24, 2026
Redirects: 1 hop · /ok/ → /ok/Windows/invite.php

WHOIS

Registrar: GoDaddy.com, LLC
Created: Feb 20, 2013
Expires: Feb 20, 2034
Nameservers: ns6167.hostgator.comns6168.hostgator.com

80 malicious4 suspicious

Hashes & fingerprints

Page Hashd50ef78ba7739c037a0d69275b7cb85fda5a22f1154eaa1d17a3868d51f80bfe Favicon Hash406bc1aa52c9c1e14d60ad19c4f2a72308f3d0289d94269c5b78a892d71f3418 DOM Hash8084154a1413eaa8cd4620f811548d1cc56cf9f8b2b25609819195c5bd3cd3ba Screenshot pHashe626999966669999 JARM29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1 JA4Xa373a9f83c6b_7022c563de38_0321e8b32200 Cert ThumbprintFE525AD846C8607585E66DBA470F9BBA954C7202 Cert IssuerCN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB

Page capture

Live

Title “Zoom Client Update” · brand shown: Zoom (low)

Visit Site

Engines

8 · time to verdict