Scan report · about 2 months agoPublic

gudwa.com

65.181.116.251AS36454 · GB

page delivers a executable (https://gudwa.com/DocuSign/download.php)

document pretext ("docusign")
Engine tags
Verdict

What happened

Step by step, from what the scanner recorded.
Load 12.3 s · 10 requests
01 · Visitor opensgudwa.com/DocuSign/
02 · Redirected · 2 hopsSame host, another address/DocuSign/e-sign.php
03 · Page shown
e-signstyled as DocuSign · low
04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Be careful — warning signs found

Automated

Its page title claims to be DocuSign, which this address is not associated with. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first
SupportingPage delivers an executable under a document pretext
https://gudwa.com/DocuSign/download.php · document pretext ("docusign")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected
DocuSign · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP
65.181.116.251WHG-DAL - WHG Hosting Services Ltd, GB · AS36454GB
TLS
CN=YR2, O=Let's Encrypt, C=US · expires Oct 4, 2026
Redirects
2 hops · /DocuSign/ → /DocuSign/e-sign.php

WHOIS

Registrar
Netregistry Wholesale Pty Ltd
Created
Jul 6, 2026
Expires
Jul 6, 2027
Nameservers
ns1.verpex.comns2.verpex.comns3.verpex.comns4.verpex.com
36 malicious5 suspicious

Hashes & fingerprints

Page capture

Live

Title “e-sign” · brand shown: DocuSign (low)

Engines

7 · time to verdict

Page

HTTP
200 · Completed
Title
e-sign
Load
12.32 s · 10 requests
Stack · 2LiteSpeedPHP