Scan report · 10 days agoPublic

fiberhost.net

163.227.239.46AS150142 · BD

Landed onhttps://fiberhost.net/gleview/Windows/invite.php· 1 redirect

this page sends its visitors on to https://fiberhost.net/gl…ew/Windows/update.html, which handed our browser a ScreenConnect executable file ("ScreenConnect.ClientSetup.exe", https://fiberhost.net/gl…onnect.ClientSetup.exe) with no click

ScreenConnect client re-hosted off-vendor (ScreenConnect.ClientSetup.exe); execution instructions ("downloads folder")

Engine tags

Executable deliveredAuto-download

Verdict

3 of 7 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

After a short wait it sends you on to another page on the same site (https://fiberhost.net/gleview/Windows/update.html), and that page hands over a program to run on your computer. It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

What happened

Step by step, from what the scanner recorded.

Load 34.3 s · 12 requests

01 · Visitor opensfiberhost.net/gleview/

02 · Redirected · 1 hopSame host, another address/gleview/Windows/invite.php

03 · Page shown

Google Meet | Secure Video Meetingsstyled as Google · low

04 · File delivered · maliciousScreenConnect.ClientSetup.exeHanded over by the page, not served at the scanned address.

05 · OutcomeRemote control of the machineA legitimate remote-management tool, enrolled into the attacker's tenant. The tenant is the takedown target.

Findings

Strongest first

MalwareMalware found in the downloaded file

ScreenConnect.ClientSetup.exe

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 01037ee9d5121f802e2b6c69799c06c96136579f6c9006676303e26bc31c4633

StrongSends visitors to a page that hands over a program

https://fiberhost.net/gleview/Windows/update.html · ScreenConnect

The page we scanned shows a wait screen and names one page on its own site as where it is about to send the visitor. We opened that page in our browser and it handed us a file — "ScreenConnect.ClientSetup.exe" from https://fiberhost.net/gleview/Windows/ScreenConnect.ClientSetup.exe — without anyone clicking anything. ScreenConnect client re-hosted off-vendor (ScreenConnect.ClientSetup.exe); execution instructions ("downloads folder")

Analyst noteWe hold this file — it was delivered to our browser, so the file analysis on this scan is of the real payload rather than of the page. Nothing was clicked: the second page starts the download by itself. The submitted address only leads there, which is why it looks empty on its own.

StrongThe delivered file installs a remote-management tool (ScreenConnect)

ScreenConnect.ClientSetup.exe

The file this page handed over is the ScreenConnect installer itself ("ScreenConnect.ClientSetup.exe"). Remote-management tools are legitimate software; what makes this an attack is that the visitor was given one under a different pretext, so the attacker ends up with remote control of the machine.

Analyst noteWe read this off the file the page handed over, not off the page: what the visitor was promised and what they received are different programs. ⚠️ The installer itself may well be signed and analyse Clean, because it IS the real product; the abuse is the pretext and the tenant it enrols into. Check that tenant before assuming it is not yours.

InfoBrand impersonation detected

Google · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMaliciousScreenConnect.ClientSetup.exe

SHA-25601037ee9d5121f802e2b6c69799c06c96136579f6c9006676303e26bc31c4633

Fromhxxps://fiberhost[.]net/gleview/Windows/ScreenConnect[.]ClientSetup[.]exe

Infrastructure

IP: 163.227.239.46WOLAST-AS-AP - Wolast Technologies, BD · AS150142BD
TLS: CN=YR2, O=Let's Encrypt, C=US · expires Dec 15, 2026
Redirects: 1 hop · /gleview/ → /gleview/Windows/invite.php

WHOIS

Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Created: Nov 13, 2024
Expires: Nov 13, 2027
Nameservers: bdns55.xeenith.combdns56.xeenith.com

Related scans · 63

Hashes & fingerprints

Page Hash36ea1b0b4f3a1a799beedafe83c5b1cfc54c141157050eb25488b5e1d617dc8a DOM Hashdeb1cd10fd9ec1a4304768be376e7eb77c02be004b0217fab5a2d036afb11a8b Screenshot pHashe99696693196cd49 JARM15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint7CD74915541B294411D81369DC19D0006B399DCE Cert IssuerCN=YR2, O=Let's Encrypt, C=US

Page capture

Live

Title “Google Meet | Secure Video Meetings” · brand shown: Google (low)

Visit Site

Engines

7 · time to verdict