Security Scan Report: hostmyclaudehtml.com

Submitted: Completed: publiccompleted
This website contacted 6 IPs in 1 country across 5 domains to perform 7 HTTP transactions. The main domain is hostmyclaudehtml.com and was registered 7 months ago.

Submitted URL: https://hostmyclaudehtml.com/p/reQJWm7Gkn

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

DocuSign-branded credential phishing page on an unrelated domain: password login form, an 'expired login' lure, a corroborated phishing threat-intel hit, and a Telegram bot token wired up to exfiltrate captured credentials.

Risk Factors (6)
Impersonation of DocuSign (a different entity's brand) on a domain that is not DocuSign's official domain
Multi-source corroborated phishing threat-intelligence match against the primary domain
Login form capturing email address and password
Telegram bot token embedded in inline script — credential exfiltration channel to attacker-controlled chat
Expired-session urgency lure combined with re-entry of 'email password' (a credential a mail provider would never ask for on a DocuSign page)
Domain unranked in Cisco Umbrella top 1M and very low business-legitimacy score (10/100)
Domain age information unavailable

Details

Page Title

DocuSign

Scan Type

public

Domain Name Analysis

You're looking at domain 'hostmyclaudehtml.com' on the commercial generic top-level domain (.com) while skipping any subdomain. The second-level label 'hostmyclaudehtml' is 16 characters long with 4 vowels and twelve consonants. Segmentation suggests 4 words: host, my, claude, html. Expect four characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Your email login time has expired, Please log in again. Email address: Enter Email

Page Load Overview

1.14s
Total Load Time
96 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:ko
Text Length:266 chars
Detector Agreement:100%
Language mismatch: Declared as ko but detected as en

Website Classification

Primary Category

documentation technical61% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
61%
news media journalism
54%
phishing scam
50%
government public service
45%
adult content
44%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
234.111.179.208Google · CDNKansas City, Missouri, United States
AS396982Google LLC
1142.251.14.95Google · CDNUnited States
AS15169Google LLC
1142.250.154.95Google · CDNUnited States
AS15169Google LLC
1142.251.110.94Google · CDNUnited States
AS15169Google LLC
1104.18.25.163Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.24.163Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
76--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A53286166DE708457553E4B83BA7A306F134C0075D06DE283EACA3A88F5AD82D97F79C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:F4UdL7wOuv4JA9cOy9QNy8N7z41dG+tYA2rikiBi5iFhhBB322Ictalpoj:mUM79f6c7iHYAcikiBi5iF/BI1lpq

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:11868:A7AQEBRWNATAgYqkIBUHbRkQEEEDIhOaISkCE4MJDUIMRAwKqGYwScj5CiB6ZhMFz8AoIUCcAK5AagEIpHgFgAIXSVEqDZog

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffefe7e7ffff
Perceptual Hash:b388cc6733996666
Difference Hash:000008080c0c0000
Wavelet Hash:f0f0e4e424243c3c
Color Hash:N/A

Other Hashes

Crop Resistant:000008080c0c0000

Scan History

Scan history not available

Unable to load historical scan data