Scan report · about 1 month agoPublic

docguard.live

35.157.26.135AS16509 · US

Submittedhttps://docguard.live

Landed onhttps://docguard.live/

page delivers an executable (https://docguard.live/jkhsSs1CJ.cmd)

delivers a script, not an installer ("jkhsSs1CJ.cmd"); document pretext ("invoice") on a full website

Engine tags

Verdict

1 of 8 enginesSuspiciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 4.3 s · 16 requests

01 · Visitor opensdocguard.live

02 · Page shown

Docguard | Detects suspicious files!styled as FedEx · low

03 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Be careful — warning signs found

Automated

Its page title claims to be FedEx, which this address is not associated with. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

SupportingPage delivers an executable under a document pretext

https://docguard.live/jkhsSs1CJ.cmd · delivers a script, not an installer ("jkhsSs1CJ.cmd"); document pretext ("invoice") on a full website

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

FedEx · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime

1 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-2563e817010b087dac7ab4c2ccde9b34d1c961c06b9a0d79703332fc6694c9216b6

Fromhxxps://docguard[.]live

Infrastructure

IP: 35.157.26.135AMAZON-02 - Amazon.com, Inc., US · AS16509US
TLS: CN=YE2, O=Let's Encrypt, C=US · expires Oct 19, 2026
Redirects: 0 hops · / → /

WHOIS

Registrar: Name.com, Inc.
Created: May 22, 2026
Expires: May 22, 2027
Nameservers: dns4.p08.nsone.netdns3.p08.nsone.netdns2.p08.nsone.netdns1.p08.nsone.net

40 malicious207 suspicious

Hashes & fingerprints

Page Hash1aaf82ad6d835bee53f9cc662434cecd24aad6b7522abe63af01b1f91e5fca5c Favicon Hash8089712b97e80b315b8ca5e97e6f7b139a817c0b495f7f79caa82b8b07dd6f97 DOM Hash384641d8a2eb1cadcb7d72ca4a47f6ae8ee50799a9d910ffaf5894f2f9cbbf7b Screenshot pHasha4a0bb2bce4ab927 JARM40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint5871757DDAB99A8F9E1ABD5107D84C3449AAB1A8 Cert IssuerCN=YE2, O=Let's Encrypt, C=US

Page capture

Live

Title “Docguard | Detects suspicious files!” · brand shown: FedEx (low)

Visit Site

Engines

8 · time to verdict