Scan report · about 2 months agoPublic

docusign-server.github.io

185.199.109.153AS54113 · US

Submittedhttps://docusign-server.github.io/RFP2026/

this page presents a document workflow ("docusign") and sends every link to file-iwl3.w-4mm9yl.workers.dev, where a verification gate opens onto a sign-in screen the page builds in memory (blob:) and asks the visitor for a password

Verdict

1 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 1.5 s · 4 requests

01 · Visitor opensdocusign-server.github.io/RFP2026/

02 · Page shown

DocuSign – Document Readystyled as DocuSign · medium

03 · Sent on tofile-iwl3.w-4mm9yl.workers.devA sign-in form waits there.

Dangerous — confirmed threat

Automated

Its page title claims to be DocuSign, which this address is not associated with. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

StrongEvery link leads to a credential screen

file-iwl3.w-4mm9yl.workers.dev · pressed "Hold to verify"

This page sends its whole clickable surface to one unrelated address. We opened it, pressed the control it offered, and the page advanced into a sign-in screen it BUILT IN MEMORY (a blob: document, which has no address anyone can check) and asked for a password.

Analyst noteThe credential screen is one navigation away from this page, not on it — which is why the page itself looks harmless. Treat file-iwl3.w-4mm9yl.workers.dev as the phishing host and check for other pages funnelling to it.

InfoBrand impersonation detected

DocuSign · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 185.199.109.153FASTLY - Fastly, Inc., US · AS54113US
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Oct 31, 2026

26 malicious7 suspicious

Hashes & fingerprints

Page Hash13899415d16a677d8943b5b1e143fd16ba6fc6a16873c5ea46d15502cfa3787f DOM Hashaaeb81b39576cdfc0da255de6bf8e20c5a7d523d22955bad935ba108b37941ab Screenshot pHash9f60e09f0f691f42 JARM29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint74C636182EB8A36DCE932CD47AAC154F693DBA61 Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

Title “DocuSign – Document Ready” · brand shown: DocuSign (medium)

Visit Site

Engines

7 · time to verdict