beyondfitness.com.br
50.116.112.113AS31898 · USSuspicious: page delivers an executable (https://beyondfitness.c…m-installer-silent.vbs)
- Delivered filemalicious
- Delivered filemalicious
- Open Directory Scanmalicious
- Browser Analysissuspicious
- Threat Intelligenceclean
- Network & Hostingclean
- Related Infrastructureclean
- TLS Fingerprintunknown
- +1 more below
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
AutomatedIts page title claims to be Microsoft, which this address is not associated with. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstWe analysed the file this page delivered — it is Malicious.
Success
SHA-256 3f50f278947223d4c75e649be6f514fda21d439dabcfdc9d25c2d823c99784e3
The page automatically triggered a file download. Normal landing pages don't do this; malware droppers do.
Analyst noteCheck the file name/type. An auto-download of an executable or archive is a strong malware-delivery tell.
The page presents itself as a document but its button downloads a program to run, not a document to read.
Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileMaliciousThe engine stored it under a generated name
SHA-2563f50f278947223d4c75e649be6f514fda21d439dabcfdc9d25c2d823c99784e3
Fromhxxps://beyondfitness[.]com[.]br/wp-includes/zlc/zoom-installer-silent[.]vbs
Infrastructure
- IP
- 50.116.112.113ORACLE-BMC-31898 - Oracle Corporation, US · AS31898US
- TLS
- CN=YR2, O=Let's Encrypt, C=US · expires Nov 15, 2026
Hashes & fingerprints
Page capture
LiveTitle “Zoom - Microsoft Store” · brand shown: Microsoft (low)
Engines
9 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Zoom - Microsoft Store
- Load
- 12.05 s · 12 requests