{
 "paper": "NSS-ZM-01",
 "title": "Fake Zoom update page installs a self-hosted ScreenConnect client: technical analysis",
 "tlp": "CLEAR",
 "publisher": "Nexus Sentinel Station (NSS)",
 "url": "https://nsshq.com/research/fake-zoom-update-remote-access",
 "published": "2026-11-12",
 "note": "Indicators are written in full, not defanged: handle with care. The lure page's own addresses belong to a shared hosting platform and are not indicators.",
 "count": 9,
 "indicators": [
  {
   "type": "domain",
   "value": "zoom-0xcdlive-join-00ccxxd.live",
   "note": "The lure page: a fake Zoom update window",
   "registered_utc": "2026-11-11T14:31:34Z",
   "registrar": "NameCheap, Inc.",
   "first_recorded_by_nss_utc": "2026-11-12T04:08:47Z"
  },
  {
   "type": "url",
   "value": "https://min.garincon.com/Bin/ScreenConnect.ClientSetup.msi",
   "note": "The installer the Update button downloads",
   "registered_utc": "",
   "registrar": "",
   "first_recorded_by_nss_utc": ""
  },
  {
   "type": "domain",
   "value": "min.garincon.com",
   "note": "Download host and the operator's remote-access web portal",
   "registered_utc": "",
   "registrar": "",
   "first_recorded_by_nss_utc": ""
  },
  {
   "type": "domain",
   "value": "garincon.com",
   "note": "Registered domain of the download host",
   "registered_utc": "2026-10-12T17:51:24Z",
   "registrar": "Ultahost, Inc.",
   "first_recorded_by_nss_utc": ""
  },
  {
   "type": "domain",
   "value": "524ff283-2094-4f98-b68d-f24f61c5f8fa.dotinicon.com",
   "note": "Connect-back host set inside the installer, port 8041",
   "registered_utc": "",
   "registrar": "",
   "first_recorded_by_nss_utc": ""
  },
  {
   "type": "domain",
   "value": "dotinicon.com",
   "note": "Registered domain of the connect-back host",
   "registered_utc": "2026-09-09T14:52:17Z",
   "registrar": "Ultahost, Inc.",
   "first_recorded_by_nss_utc": ""
  },
  {
   "type": "ipv4",
   "value": "45.87.61.155",
   "note": "The server behind both: relay on port 8041 and origin of the download portal",
   "registered_utc": "",
   "registrar": "",
   "first_recorded_by_nss_utc": ""
  },
  {
   "type": "hash",
   "value": "c98e783442a4ca72244f3bb1d5f8ad28bc1f3f94db8a5afac9597a7c870ca590",
   "note": "SHA-256 of ScreenConnect.ClientSetup.msi, 15,216,640 bytes, client id 230f9b38c3c088fe",
   "registered_utc": "",
   "registrar": "",
   "first_recorded_by_nss_utc": ""
  },
  {
   "type": "hash",
   "value": "e6142c9c458795d1fea5e18288c1adfb",
   "note": "MD5 of the same installer",
   "registered_utc": "",
   "registrar": "",
   "first_recorded_by_nss_utc": ""
  }
 ]
}