cloud.repeatcarrental.com
188.114.97.1AS13335 · USthis page sends its visitors on to https://cloud.repeatcarr…ws/microsoft-store.php, which handed our browser an executable file ("ZoomWorkspace.ClientSetup.exe", https://cloud.repeatcarr…g/Windows/download.php) with no click
- Browser Analysismalicious
- Threat Intelligencemalicious
- Delivered filesuspicious
- Network & Hostingclean
- Related Infrastructureclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
AutomatedIts page title claims to be Zoom, which this address is not associated with. After a short wait it sends you on to another page on the same site (https://cloud.repeatcarrental.com/meeting/Windows/microsoft-store.php), and that page hands over a program to run on your computer. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstWe analysed the file this page delivered — it is Suspicious.
Success
SHA-256 b1aafcf30074a4b4c7cff06aeeb168c35151d20397015a3fffa070545347042b
The page we scanned shows a wait screen and names one page on its own site as where it is about to send the visitor. We opened that page in our browser and it handed us a file — "ZoomWorkspace.ClientSetup.exe" from https://cloud.repeatcarrental.com/meeting/Windows/download.php — without anyone clicking anything. brand impersonation (Zoom, medium)
Analyst noteWe hold this file — it was delivered to our browser, so the file analysis on this scan is of the real payload rather than of the page. Nothing was clicked: the second page starts the download by itself. The submitted address only leads there, which is why it looks empty on its own.
The page automatically triggered a file download. Normal landing pages don't do this; malware droppers do.
Analyst noteCheck the file name/type. An auto-download of an executable or archive is a strong malware-delivery tell.
The file this page handed over carries the Faronics agent's own component names in its contents ("FaronicsSA.exe"), under a name that says nothing about it. Remote-management tools are legitimate software; what makes this an attack is that the visitor was given one under a different pretext, so the attacker ends up with remote control of the machine.
Analyst noteThis name came out of the delivered bytes themselves — nothing opened or unpacked the file, so treat it as a strong hint about WHICH tool, not as proof of what the installer does. The page offered an update and the download is named after it, which is why neither mentions Faronics. ⚠️ Expect the installer to be signed and to analyse Clean, because it IS the real product; the abuse is the pretext and the tenant it enrols into. Check that tenant before assuming it is not yours.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileSuspiciousZoomWorkspace.ClientSetup.exe
SHA-256b1aafcf30074a4b4c7cff06aeeb168c35151d20397015a3fffa070545347042b
Fromhxxps://cloud[.]repeatcarrental[.]com/meeting/Windows/download[.]php
Infrastructure
- IP
- 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=WE1, O=Google Trust Services, C=US · expires Dec 17, 2026
- Redirects
- 1 hop · /meeting/ → /meeting/Windows/invite.php
WHOIS
- Registrar
- Isimtescil Bilisim A.S.
- Created
- Jan 31, 2025
- Expires
- Jan 31, 2030
- Nameservers
- melody.ns.cloudflare.comtitan.ns.cloudflare.com
Hashes & fingerprints
Page capture
LiveTitle “Zoom Client Update” · brand shown: Zoom (medium)
Engines
7 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Zoom Client Update
- Load
- 10.51 s · 15 requests