Scan report · about 2 months agoPublic

landingingtradesinternational.com

162.246.16.124AS19318 · US

Submittedhttps://landingingtradesinternational.com/

page delivers an executable (https://landingingtrade…t/Secured_document.msi)

brand impersonation (DocuSign, medium); document pretext ("docusign")

Engine tags

Verdict

4 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 14.8 s · 8 requests

01 · Visitor openslandingingtradesinternational.com

02 · Page shown

e-signstyled as DocuSign · medium

03 · File delivered · malicious92e8b5ae-5d56-4aa6-9523-848cb7f819a3.msilandingingtradesinternational.comHanded over by the page, not served at the scanned address.

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be DocuSign, which this address is not associated with. It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

92e8b5ae-5d56-4aa6-9523-848cb7f819a3.msi

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 3828bb23aa9334de9536a6e5bbd01fb8264d4a48f5c41ba519e1127d632ee8b5

SupportingPage delivers an executable under a document pretext

https://landingingtradesinternational.com/document/Secured_document.msi · brand impersonation (DocuSign, medium); document pretext ("docusign")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

DocuSign · medium · logo shown, brand named only in body text

The page DISPLAYS a known brand's logo while carrying almost no content of its own — no article, no navigation, nothing the brand's own site would have.

Analyst noteThe brand is in the page's images, not just its words, and the page has nothing else on it. Check what the page is asking the visitor to do.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMaliciousThe engine stored it under a generated name

SHA-2563828bb23aa9334de9536a6e5bbd01fb8264d4a48f5c41ba519e1127d632ee8b5

Fromhxxps://landingingtradesinternational[.]com/document/Secured_document[.]msi

Infrastructure

IP: 162.246.16.124IS-AS-1 - Interserver, Inc, US · AS19318US
TLS: CN=YE2, O=Let's Encrypt, C=US · expires Nov 14, 2026

WHOIS

Registrar: Tucows Domains Inc.
Created: Aug 16, 2026
Expires: Aug 16, 2027
Nameservers: aaron.ns.cloudflare.combrynne.ns.cloudflare.com

57 malicious11 suspicious

Hashes & fingerprints

Page Hash56a07b393a91c600de7a6585305a7ab55c8444c9418ebd8d4162c2a482b32f47 Favicon Hash326b79b9d1123740137a2eadd44ed4db857d8a7928f095a385fa1593526471bf DOM Hash022b21ed01ee81aa71b9911f820ee77c3c8fdb90719849b33305b694f5649239 Screenshot pHashec6c939393924a6d JARM27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a Cert Thumbprint39193905B8A30B129E1598FAA5D37FBE44124E81 Cert IssuerCN=YE2, O=Let's Encrypt, C=US

Page capture

Live

Title “e-sign” · brand shown: DocuSign (medium)

Visit Site

Engines

8 · time to verdict