Security Scan Report: awarenesss.cfd

Submitted: Sep 15, 2026, 4:45:19 PMCompleted: Sep 15, 2026, 4:45:55 PMpubliccompleted

This website contacted 10 IPs in 2 countries across 10 domains to perform 17 HTTP transactions. The main domain is awarenesss.cfd and was registered 23 years ago.

Submitted URL: https://awarenesss.cfd/Review/cgi-bin/docusign.html

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Fake DocuSign document-signing page on awarenesss.cfd, a domain flagged by threat intel as MuddyWater malware. Clear brand impersonation and phishing design — do not interact.

Risk Factors (5)
Known malware-family (MuddyWater/APT) IoC match on the primary scanned domain
Brand impersonation of DocuSign on a non-DocuSign domain
Phishing-style verification/credential-collection lure
Unranked domain with minimal legitimacy signals
Suspicious JavaScript code-generation and encoding usage
Domain age information unavailable

Details

Page Title

Sign Document - SecureSign

Scan Type

public

Domain Name Analysis

The domain 'awarenesss.cfd' uses the .cfd top-level domain and has no subdomain. The second-level label 'awarenesss' is 10 characters long holding four vowels versus 6 consonants. Breaking it apart gives 2 words: awareness, s. Expect five characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://awarenesss.cfd/Review/cgi-bin/docusign.html

Page Load Overview

2.46s
Total Load Time
1.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:258 chars
Detector Agreement:100%

Website Classification

Primary Category

real estate property60% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

real estate property
60%
government public service
44%
healthcare medical
44%
corporate business
38%
news media journalism
37%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8104.19.229.21Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1192.178.170.95Google · CDNUnited States
AS15169Google LLC
1185.15.59.224United States
AS14907Wikimedia Foundation Inc.
1141.95.77.141France
AS16276OVH SAS
1192.178.183.95Google · CDNUnited States
AS15169Google LLC
1142.251.20.95Google · CDNUnited States
AS15169Google LLC
1142.251.14.94Google · CDNUnited States
AS15169Google LLC
174.125.29.95Google · CDNUnited States
AS15169Google LLC
1104.18.13.205Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.19.230.21Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1710--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F9F0D457784D445E0960ED8069B0B16E68B6A8797E919E917CE08029ED783ED8445D44

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12:hR2Ay7IJ2NwOaZLbADRQykAb9z8NWQwNVG:hR2ACV/aZurv18dwNVG

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:1:0:929db58666e536d7a54151303edccd5c

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:003c3cffffffff00
Perceptual Hash:ce1331e539f94e18
Difference Hash:55f0616969616116
Wavelet Hash:00243cffffff3000
Color Hash:#79c9d2

Scan History

Scan history not available

Unable to load historical scan data