Scan report · 3 months agoPublic

docusign.ostiumterms.com

172.67.198.204AS13335 · US

Submittedhttps://docusign.ostiumterms.com/

Verdict

2 of 7 enginesMaliciousAutomated

Dangerous — confirmed threat

Automated

Its web address was registered only 3 days before this scan (on 2026-07-20) — most phishing sites run on brand-new domains. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

InfoCross-domain scripts injected at runtime

5 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-2560ba3bf85b28cbb72e3a09d0dd6d0d3ab2ad9d917fe94a180c58175bc856003e2

Infrastructure

IP: 172.67.198.204CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Oct 18, 2026

WHOIS

Registrar: Squarespace Domains LLC
Created: Jul 20, 2026
Expires: Jul 20, 2027
Nameservers: becky.ns.cloudflare.comdonald.ns.cloudflare.com

3 malicious5 suspicious

Hashes & fingerprints

Page Hashdcb605e20e763fa5399aa2aaab1a61e93797e942a428192021c652ccbd7070c9 DOM Hashe1ccb11859f3dcabf78cd954c47a5a285f6a2732bc11418b574767666c8323e2 Screenshot pHashbd0e4e31c293d2b3 JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintC357F870DD443F498BD2400CBFCE097F81933645 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Docusign - Download to Review & Sign Document”

Visit Site

Engines

7 · time to verdict