Scan report · about 2 months agoPublic

www.docusignsetup.icu

172.67.209.180AS13335 · US

Submittedhttps://www.docusignsetup.icu/

page delivers an executable (https://github.com/COLD…hangeDocuSignSetup.bat)

brand impersonation (DocuSign, high); document pretext ("docusign"); delivers a script, not an installer ("LBExchangeDocuSignSetup.bat")

Engine tags

Verdict

2 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 1.2 s · 5 requests

01 · Visitor openswww.docusignsetup.icu

02 · Page shown

Docusign - Download to Review & Sign Documentstyled as DocuSign · high

03 · OutcomeCredential phishingA login page wearing a brand it does not own.

Dangerous — confirmed threat

Automated

It presents itself as DocuSign while being hosted somewhere DocuSign does not own. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingPage delivers an executable under a document pretext

https://github.com/COLDICED/LB-Exchange/releases/download/v.1.1.2/LBExchangeDocuSignSetup.bat · brand impersonation (DocuSign, high); document pretext ("docusign"); delivers a script, not an installer ("LBExchangeDocuSignSetup.bat")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

SupportingBrand impersonation detected

DocuSign · high

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteHigh confidence: brand keywords AND a password field — classic credential phishing.

Infrastructure

IP: 172.67.209.180CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 1, 2026

WHOIS

Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
Created: Aug 3, 2026
Expires: Aug 3, 2027
Nameservers: beau.ns.cloudflare.comindie.ns.cloudflare.com

58 malicious6 suspicious

Hashes & fingerprints

Page Hashc11916a09d46669cfb0f9834d09e08a89add65bd0646d32453f8c8fc03ca9193 DOM Hash120ba1b57e637afe87ba0e91039e4da3eb9943ff081d9d1b1542b5477734c627 Screenshot pHashbd0ecc31c29392f3 JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint0540DB8F3D029B106F4C6F1C85F08810B02B2051 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Docusign - Download to Review & Sign Document” · brand shown: DocuSign (high)

Visit Site

Engines

7 · time to verdict