luxfab.luxe
50.6.202.214AS19871 · USSuspicious: page delivers an executable (https://fdp122.nyc3.dig…eshared/Fileshared.msi)
- Delivered filemalicious
- Browser Analysissuspicious
- Content Inspectionclean
- Network & Hostingclean
- Threat Intelligenceclean
- Related Infrastructureclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
AutomatedIts page title claims to be Adobe, which this address is not associated with. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstWe analysed the file this page delivered — it is Malicious.
Success
SHA-256 e2a34605b9b59bac25a77ee77d0ae62dea9b441a0b2018af8dea570bc40af23f
The page's own script names an executable installer hosted on a different domain, rather than offering it as an ordinary download link.
Analyst noteThe URL was read from an inline script, so it is what the page INTENDS to deliver — a download may not have been observed. Check who operates the instance in the URL, and treat a remote-access tool offered by an unrelated lure page as a compromise attempt.
The page presents itself as a document but its button downloads a program to run, not a document to read.
Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.
The page DISPLAYS a known brand's logo while carrying almost no content of its own — no article, no navigation, nothing the brand's own site would have.
Analyst noteThe brand is in the page's images, not just its words, and the page has nothing else on it. Check what the page is asking the visitor to do.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileMaliciousFileshared.msi
SHA-256e2a34605b9b59bac25a77ee77d0ae62dea9b441a0b2018af8dea570bc40af23f
Fromhxxps://fdp122[.]nyc3[.]digitaloceanspaces[.]com/fileshared/Fileshared[.]msi
Infrastructure
- IP
- 50.6.202.214NETWORK-SOLUTIONS-HOSTING - Network Solutions, LLC, US · AS19871US
- TLS
- CN=YR1, O=Let's Encrypt, C=US · expires Dec 22, 2026
WHOIS
- Registrar
- Dominet (HK) Limited
- Country
- US
- Created
- Sep 23, 2026
- Expires
- Sep 23, 2027
- Nameservers
- ns1.2344234.xyzns2.2344234.xyz
Hashes & fingerprints
Page capture
LiveTitle “PDF Viewer” · brand shown: Adobe (medium)
Engines
8 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- PDF Viewer
- Load
- 10.29 s · 12 requests