Scan report · about 2 months agoPublic

jojolandings.com

188.114.97.1AS13335 · US

Submittedhttps://jojolandings.com/

page delivers an executable (https://jojolandings.co…cure_document_file.msi)

brand impersonation (DocuSign, medium); document pretext ("docusign")

Engine tags

Verdict

4 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 9.3 s · 8 requests

01 · Visitor opensjojolandings.com

02 · Page shown

e-signstyled as DocuSign · medium

03 · File delivered · malicious53d57056-ea33-4046-a00d-66fb978bd8e0.msijojolandings.comHanded over by the page, not served at the scanned address.

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be DocuSign, which this address is not associated with. It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

53d57056-ea33-4046-a00d-66fb978bd8e0.msi

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 cb60833fedf0960a9469797746776ec9d28ef4bad90e3ee9a92fab76fe2a1284

SupportingPage delivers an executable under a document pretext

https://jojolandings.com/document/Secure_document_file.msi · brand impersonation (DocuSign, medium); document pretext ("docusign")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

DocuSign · medium · logo shown, brand named only in body text

The page DISPLAYS a known brand's logo while carrying almost no content of its own — no article, no navigation, nothing the brand's own site would have.

Analyst noteThe brand is in the page's images, not just its words, and the page has nothing else on it. Check what the page is asking the visitor to do.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMaliciousThe engine stored it under a generated name

SHA-256cb60833fedf0960a9469797746776ec9d28ef4bad90e3ee9a92fab76fe2a1284

Fromhxxps://jojolandings[.]com/document/Secure_document_file[.]msi

Infrastructure

IP: 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 8, 2026

WHOIS

Registrar: Tucows Domains Inc.
Created: Aug 10, 2026
Expires: Aug 10, 2027
Nameservers: leah.ns.cloudflare.comridge.ns.cloudflare.com

115 malicious11 suspicious

Hashes & fingerprints

Page Hash4fbb89f152875f385ba9f1e05698c5276a3f0c6e472db16fc78f80ff6fc388b4 Favicon Hash326b79b9d1123740137a2eadd44ed4db857d8a7928f095a385fa1593526471bf DOM Hash022b21ed01ee81aa71b9911f820ee77c3c8fdb90719849b33305b694f5649239 Screenshot pHashec6c939393924a6d JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint245943942AFABC5806B2662CE23FD2EF455353FC Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “e-sign” · brand shown: DocuSign (medium)

Visit Site

Engines

8 · time to verdict