Scan report · 18 days agoPublic
Verdict

Dangerous — confirmed threat

Automated

Its page title claims to be DocuSign, which this address is not associated with. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This verdict rests on other evidence: the site never showed us its own page, so its content was not assessed. Re-scan later or verify through a trusted channel.

Findings

Strongest first
InfoBrand impersonation detected
DocuSign · medium · logo shown, brand named only in body text

The page DISPLAYS a known brand's logo while carrying almost no content of its own — no article, no navigation, nothing the brand's own site would have.

Analyst noteThe brand is in the page's images, not just its words, and the page has nothing else on it. Check what the page is asking the visitor to do.

File

The file was not analysed, so the scan carries no verdict on the file itself.

Infrastructure

IP
107.6.136.42SINGLEHOP-LLC - Internap Holding LLC, US · AS32475US
TLS
CN=YR1, O=Let's Encrypt, C=US · expires Oct 25, 2026
Redirects
3 hops · /ftx → /docsign/pdf.html?sid=eSPqj4…NGAYXjWPjICPVcHvti47PqgcxGL
56 malicious8 suspicious

Hashes & fingerprints

Page capture

Live

Title “e-sign” · brand shown: DocuSign (medium)

Engines

7 · time to verdict

Page

HTTP
200 · Completed
Title
e-sign
Load
7.61 s · 21 requests
Stack · 2HSTSPHP