Scan report · about 2 months agoPublic

jojolandings.com

188.114.97.1AS13335 · US

Submittedhttps://jojolandings.com/

page delivers an executable (https://jojolandings.co…cure_document_file.msi)

brand impersonation (DocuSign, medium); document pretext ("docusign")

Engine tags

Verdict

3 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 9.3 s · 8 requests

01 · Visitor opensjojolandings.com

02 · Page shown

e-signstyled as DocuSign · medium

03 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be DocuSign, which this address is not associated with. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingPage delivers an executable under a document pretext

https://jojolandings.com/document/Secure_document_file.msi · brand impersonation (DocuSign, medium); document pretext ("docusign")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

DocuSign · medium · logo shown, brand named only in body text

The page DISPLAYS a known brand's logo while carrying almost no content of its own — no article, no navigation, nothing the brand's own site would have.

Analyst noteThe brand is in the page's images, not just its words, and the page has nothing else on it. Check what the page is asking the visitor to do.

Infrastructure

IP: 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 8, 2026

WHOIS

Registrar: Tucows Domains Inc.
Created: Aug 10, 2026
Expires: Aug 10, 2027
Nameservers: leah.ns.cloudflare.comridge.ns.cloudflare.com

74 malicious12 suspicious

Hashes & fingerprints

Page Hash4fbb89f152875f385ba9f1e05698c5276a3f0c6e472db16fc78f80ff6fc388b4 Favicon Hash326b79b9d1123740137a2eadd44ed4db857d8a7928f095a385fa1593526471bf DOM Hash022b21ed01ee81aa71b9911f820ee77c3c8fdb90719849b33305b694f5649239 Screenshot pHashec6c939393924a6d JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint245943942AFABC5806B2662CE23FD2EF455353FC Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “e-sign” · brand shown: DocuSign (medium)

Visit Site

Engines

7 · time to verdict