gk.bnznji.net
82.165.110.163AS8560 · DEpage delivers a ScreenConnect executable (https://gk.bnznji.net/A…gital-exe/download.php)
- Browser Analysissuspicious
- Content Inspectionclean
- Threat Intelligenceclean
- Network & Hostingclean
- Delivered fileclean
- Related Infrastructureclean
- TLS Fingerprintunknown
- Domain Intelligenceunknown
What happened
Step by step, from what the scanner recorded.Be careful — warning signs found
AutomatedThis site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.
What to do
Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.
"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.
Findings
Strongest firstThe page's download button hands the visitor ScreenConnect, a genuine remote-control product, while presenting itself as a document. Once run it gives an outsider live control of the machine. The installer is validly signed by its real vendor, so antivirus and file-analysis engines correctly see nothing wrong with the file — the attack is the pretext, not the payload.
Analyst noteRMM abuse: the payload is a legitimate signed ScreenConnect client, so file reputation will be clean by design — do not read that as a false positive. The tenant hostname and the query parameters in the target URL identify the attacker's relay and are the IOC + the abuse-report target (report to the RMM vendor, not only to the hosting provider).
Files · 2
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Downloaded fileCleanThe engine stored it under a generated name
SHA-2569cc0dfa491f5eebdca6a351e699886946b0b96fdbcb7d454ea15af2fffdf6b93
Fromhxxps://gk[.]bnznji[.]net/Adobe/Adobe-digital-exe/
Delivered fileCleanScreenConnect.ClientSetup.msi
SHA-2562cf2e35468887d7754461f9133b71426162348f66c91b4e6f863fadd422d0105
Fromhxxps://gk[.]bnznji[.]net/Adobe/Adobe-digital-exe/download[.]php
Infrastructure
- IP
- 82.165.110.163IONOS-AS - IONOS SE, DE · AS8560DE
- TLS
- CN=YR2, O=Let's Encrypt, C=US · expires Nov 9, 2026
- Redirects
- 1 hop · /Adobe/Adobe-digital-exe/ → /Adobe/Adobe-digital-exe/download.html
WHOIS
- Registrar
- IONOS SE
- Created
- Jul 11, 2026
- Expires
- Jul 11, 2027
- Nameservers
- ns1.testpphpcss.shopns2.testpphpcss.shop
Hashes & fingerprints
Page capture
LiveTitle “Background Image Page”
Engines
8 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Background Image Page
- Load
- 11.06 s · 8 requests