Security Scan Report: featuresx.cloud

Submitted: Completed: publiccompleted
This website contacted 1 IP in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is featuresx.cloud and was registered 8 months ago.

Submitted URL: https://featuresx.cloud/77632/

Downloads:

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake DocuSign page on featuresx.cloud: branded as DocuSign, flagged APT MuddyWater malware by two feeds, and auto-downloads a 1.69MB script. Do not open the file.

Risk Factors (5)
Impersonation of DocuSign on a non-official domain
Multi-source threat-intel match for APT MuddyWater malware on the primary domain
Drive-by JavaScript file download presented as a signed document
Anti-analysis behavior (right-click blocking)
Domain unranked in Cisco Umbrella despite claiming a major brand
Domain age information unavailable

Details

Page Title

DocuSign — Review Document

Scan Type

public

Domain Name Analysis

The domain name 'featuresx.cloud' uses the .cloud top-level domain with no subdomain. The second-level label 'featuresx' is 9 characters long split between four vowels and five consonants. Word splitting yields 2 words: features, x. Median word length is 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://featuresx.cloud/77632/

Page Load Overview

2.25s
Total Load Time
14 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:663 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical26% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
218.130.249.183Aws · CLOUDCity of London, England, United Kingdom
AS16509Amazon.com, Inc.
21--

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T11D620976A204303A257758D1B5B6F78F30F1E14AEC97824889FD231D9BC6D935A36ACC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:M5vWNJ3p3TbRLatxLDtstjfUfG03T51q31Rf:M1WNJZfM/tstIfNq7f

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:14845:USHFMAgtEoCeoARAAECgEBSGkJZgQBEInYQywQUGQFuos5YCYTjxFhMwuFBEIlEhYi1wJRsBSbJiCmAI0QAANQEJBAIAUGGA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7ea4242c482c2000
Perceptual Hash:93d5c49d99c59515
Difference Hash:9228485810282808
Wavelet Hash:7e3ce4ec0c3c0420
Color Hash:07000002010

Other Hashes

Crop Resistant:9228485810282808

Scan History

Scan history not available

Unable to load historical scan data