Security Scan Report: alreemgroup.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 3 IPs in 1 country across 3 domains to perform 6 HTTP transactions. The main domain is alreemgroup.com and was registered 8 years ago.

Submitted URL: https://alreemgroup.com/sys/

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Fake DocuSign 'review documents' page on a compromised domain uses a sham 'verify you're human' check to push a ScreenConnect remote-access .msi — malware distribution, not a real document portal.

Risk Factors (5)
Impersonation of the DocuSign brand on a non-DocuSign domain
Fake human-verification CAPTCHA used as a pretext to get the user to run a downloaded file
Distribution of a ScreenConnect remote-access .msi installer from a third-party domain
Malicious content hosted in a /sys/ subdirectory of an unrelated, likely compromised website
Domain is unranked in Cisco Umbrella despite being 8 years old, inconsistent with a legitimate DocuSign workflow
Domain age information unavailable

Details

Page Title

DocuSign - Please Review Documents

Scan Type

public

Domain Name Analysis

The domain name 'alreemgroup.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. The core label 'alreemgroup' covers 11 characters with 5 vowels and 6 consonants. It segments into four words: al, re, em, group. The median word length lands at 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Verify you're human Quick security check required.

Page Load Overview

2.36s
Total Load Time
1.4 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:240 chars
Detector Agreement:100%

Website Classification

Primary Category

news media journalism49% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

news media journalism
49%
adult content
41%
government public service
35%
documentation technical
33%
healthcare medical
32%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
269.16.254.73United States
AS32244Liquid Web, L.L.C
2192.178.183.95Google · CDNUnited States
AS15169Google LLC
2142.251.14.94Google · CDNUnited States
AS15169Google LLC
63--

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T10E8523370E5B6D3F4A28629930264E5D7F728593A18D80DC370C518E9F89F8187AF9F6

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24576:CUs7uG/HD8B6wxmfiG81BRIROXmJ/rw4fgVwOcVhIZlRGPkSla5q4RqWKcIEMsPJ:IXD9wTT2ROXz4kwOshXPkAJ4FH44

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1788743:QKg8FJg6txENQAKgpZMICoEUQe4RBAErhlGJ4oIkqBMNACEJRAEVKAOJBYYxNVtEAugZBDhFTQHQcgggbU4iGogIAEsHgRQC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffcfc7c3cfffff
Perceptual Hash:b198ce663199cd66
Difference Hash:1024189c9d1a2410
Wavelet Hash:3f3f0f0f03030f0f
Color Hash:N/A

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data