ScanMalware.com

Security Scan Report: new.express.adobe.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/c9dcb60d-c039-403c-b6dc-037d8b8ca08fDomain and IP registration (RDAP)/api/v1/rdap/c9dcb60d-c039-403c-b6dc-037d8b8ca08fHow often this domain was scanned/api/v1/domain/stats/new.express.adobe.comScan history for this domain/api/v1/domain/history/new.express.adobe.com?limit=15
This website contacted 46 IPs in 6 countries across 19 domains to perform 274 HTTP transactions. The main domain is adobe.com and was registered 39 years ago.

Submitted URL: https://new.express.adobe.com/webpage/aecgh54nKAQXs

The Cisco Umbrella rank of the primary domain is #154 of the top 1 million websitesTop 1K Site

AI Security Verdict

Low Risk

Confidence: 88%

3
Risk Score

Adobe Express user page impersonating AT&T with a 'verify your email address' account-update lure on a domain that is not AT&T's — brand impersonation/phishing pretext, though no credential form was captured.

Risk Factors (3)
Impersonation of a different entity's brand (AT&T) on a non-AT&T domain
Phishing pretext ('verify your email address' to regain account access) attributed to AT&T
Legitimate Adobe Express hosting abused to lend credibility to an unrelated brand page
Safety Factors (6)
Hosting domain (adobe.com) is 39 years old, top-1K ranked in Cisco Umbrella, and belongs to Adobe
No credential or payment fields in the captured DOM (0 password, 0 payment)
No threat-intel matches, no YARA malware patterns, no known-kit roster hit
No credential exfiltration or cross-origin form submission detected
Only INFO-level Suricata alerts (webshell heuristic false-positive class), not corroborated by IoC/YARA/Safe Browsing
Top-ranked domain (Cisco Umbrella #154, 14590 days old) with no strong malicious indicators — a login form on a household-name site is normal; risk clamped from 8 to 3
Domain age information unavailable

Details

Page Title

Currently

Scan Type

public

Domain Name Analysis

The domain 'new.express.adobe.com' uses the commercial generic top-level domain (.com) with subdomain 'new.express'. Its registrable label 'adobe' stretches across 5 characters holding 3 vowels versus two consonants. Tokenizing the label suggests one word: adobe. Expect 5 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://new.express.adobe.com/webpage/aecgh54nKAQXs

Page Load Overview

7.27s
Total Load Time
6.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:7,687 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software78% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
78%
government public service
64%
documentation technical
62%
blog personal website
59%
news media journalism
52%

Detected Features

Search
OG: website

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4918.66.112.98Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
518.66.112.22Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
52.23.154.64Akamai · CDNVienna, Vienna, Austria
AS20940Akamai International B.V.
534.250.67.152Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
52.21.110.209Akamai · CDNHamburg, Free and Hanseatic City of Hamburg, Germany
AS20940Akamai International B.V.
5184.24.77.135Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
523.37.192.204Akamai · CDNBerlin, State of Berlin, Germany
AS16625Akamai Technologies, Inc.
523.52.181.12Akamai · CDNFrankfurt am Main, Hesse, Germany
AS16625Akamai Technologies, Inc.
5162.159.140.165Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
5104.18.87.42Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
27446--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1AB94609B39A2161DD6E7831C9696B6803510A88FFE7B9CECF14CA3748F8C7E14D5134A

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:zFz42fgPgRcmuKYr6Ej3gE0C6A3ECMM6YDEI3b:K1b

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:417133:DCFHIw6CYqIESHi/MBzSlQIaACFAQEAjxkgiYWEuEAm1INdAgCyAEVECgAgKQkQFAUAqIcPgShlIhwYeCEUAGdjyemFg/CyB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0f0f0f0f0f0fffff
Perceptual Hash:9331fe381ee403ec
Difference Hash:1adadbdbdbda5a79
Wavelet Hash:0f0f0f0f0f0f878d
Color Hash:#c3c587

Other Hashes

Crop Resistant:1adadbdbdbda5a79,71f0fcbefebefc71,2816b27979b17069

Scan History

Scan history not available

Unable to load historical scan data