Scan report · about 2 months agoPublic

gudwa.com

65.181.116.251AS36454 · GB

Submittedhttps://gudwa.com/DocuSign/

Landed onhttps://gudwa.com/DocuSign/e-sign.php· 2 redirects

page delivers a executable (https://gudwa.com/DocuSign/download.php)

document pretext ("docusign"); delivers a script, not an installer ("DocuSign.vbs")

Engine tags

Verdict

1 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 12.1 s · 10 requests

01 · Visitor opensgudwa.com/DocuSign/

02 · Redirected · 2 hopsSame host, another address/DocuSign/e-sign.php

03 · Page shown

e-signstyled as DocuSign · low

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be DocuSign, which this address is not associated with. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingPage delivers an executable under a document pretext

https://gudwa.com/DocuSign/download.php · document pretext ("docusign"); delivers a script, not an installer ("DocuSign.vbs")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

DocuSign · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 65.181.116.251WHG-DAL - WHG Hosting Services Ltd, GB · AS36454GB
TLS: CN=YR2, O=Let's Encrypt, C=US · expires Oct 4, 2026
Redirects: 2 hops · /DocuSign/ → /DocuSign/e-sign.php

WHOIS

Registrar: Netregistry Wholesale Pty Ltd
Created: Jul 6, 2026
Expires: Jul 6, 2027
Nameservers: ns1.verpex.comns2.verpex.comns3.verpex.comns4.verpex.com

57 malicious18 suspicious

Hashes & fingerprints

Page Hash1e3f91f2bfbf055e3a6f006a9dbba6e2a8612f8f8a6e92d5c3c35fd94999eba4 DOM Hasha6c02aa1832d9f5f4c1f43abd21fa0c77094698ce10eb74025e512c9abfd751a Screenshot pHashec6c939392926a6d JARM29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintBC5D8E1174C6359472BEEE0A04A5C2D1491F30B9 Cert IssuerCN=YR2, O=Let's Encrypt, C=US

Page capture

Live

Title “e-sign” · brand shown: DocuSign (low)

Visit Site

Engines

7 · time to verdict