Scan report · about 2 months agoPublic

gudwa.com

65.181.116.251AS36454 · GB

Submittedhttps://gudwa.com/DocuSign/

Landed onhttps://gudwa.com/DocuSign/e-sign.php· 2 redirects

page delivers a executable (https://gudwa.com/DocuSign/download.php)

document pretext ("docusign"); delivers a script, not an installer ("DocuSign.vbs")

Engine tags

Verdict

2 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 12.3 s · 10 requests

01 · Visitor opensgudwa.com/DocuSign/

02 · Redirected · 2 hopsSame host, another address/DocuSign/e-sign.php

03 · Page shown

e-signstyled as DocuSign · low

04 · File delivered · maliciousDocuSign.vbsgudwa.comHanded over by the page, not served at the scanned address.

05 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be DocuSign, which this address is not associated with. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

DocuSign.vbs

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 c85558ed23c42139db74e3976c58c0c9585be8439d0598d54535399db7c15838

SupportingPage delivers an executable under a document pretext

https://gudwa.com/DocuSign/download.php · document pretext ("docusign"); delivers a script, not an installer ("DocuSign.vbs")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

DocuSign · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMaliciousDocuSign.vbs

SHA-256c85558ed23c42139db74e3976c58c0c9585be8439d0598d54535399db7c15838

Fromhxxps://gudwa[.]com/DocuSign/download[.]php

Infrastructure

IP: 65.181.116.251WHG-DAL - WHG Hosting Services Ltd, GB · AS36454GB
TLS: CN=YR2, O=Let's Encrypt, C=US · expires Oct 4, 2026
Redirects: 2 hops · /DocuSign/ → /DocuSign/e-sign.php

WHOIS

Registrar: Netregistry Wholesale Pty Ltd
Created: Jul 6, 2026
Expires: Jul 6, 2027
Nameservers: ns1.verpex.comns2.verpex.comns3.verpex.comns4.verpex.com

121 malicious16 suspicious

Hashes & fingerprints

Page Hash1e3f91f2bfbf055e3a6f006a9dbba6e2a8612f8f8a6e92d5c3c35fd94999eba4 DOM Hasha6c02aa1832d9f5f4c1f43abd21fa0c77094698ce10eb74025e512c9abfd751a Screenshot pHashec6c939392926a6d JARM29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintBC5D8E1174C6359472BEEE0A04A5C2D1491F30B9 Cert IssuerCN=YR2, O=Let's Encrypt, C=US

Page capture

Live

Title “e-sign” · brand shown: DocuSign (low)

Visit Site

Engines

8 · time to verdict