Security Scan: 502 Bad Gateway

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/0215dbc9-5b8f-4508-a97e-f0086b2c20a2 Domain and IP registration (RDAP)/api/v1/rdap/0215dbc9-5b8f-4508-a97e-f0086b2c20a2 Certificate Transparency/api/v1/ct/docu-sign.creativaplanning.com How often this domain was scanned/api/v1/domain/stats/objectstorage.ap-sydney-1.oraclecloud.com Scan history for this domain/api/v1/domain/history/objectstorage.ap-sydney-1.oraclecloud.com?limit=15

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main domain is docu-sign.creativaplanning.com and was registered 4 months ago.

Submitted URL: https://objectstorage.ap-sydney-1.oraclecloud.com/n/sdl2lsmh7igo/b/Wire/o/paybonus.htm

Effective URL:

https://docu-sign.creativaplanning.com/

Redirected

The Cisco Umbrella rank of the primary domain is #4,295 of the top 1 million websitesTop 10K Site

AI Security Verdict

Moderate Risk

Confidence: 55%

Risk Score

Page served only a 502 error: no forms, no IoCs, no malware. The suspicious piece is infrastructure - a cloud-storage lure redirecting to a 'docu-sign' lookalike host. Unverifiable, treat cautiously.

Risk Factors (5)

Deceptive-looking hostname 'docu-sign.creativaplanning.com' borrowing the DocuSign name on a domain that is not DocuSign's

Phishing-typical URL shape: cloud-storage bucket hosting 'paybonus.htm' that forwards to a third-party lookalike host

Right-click / context-menu blocking JavaScript

Mismatched page title ('Microsoft Outlook') versus hostname and visible error text

No content rendered, so the page's real purpose cannot be verified either way

Safety Factors (6)

No forms of any kind, therefore no credential or payment collection on the captured page

No Indicators of Compromise matched against the page or its loaded resources

No JavaScript malware YARA patterns and no native-YARA-scanner high-precision hits

No Suricata network IDS alerts

All JavaScript served from the site's own domain; no cross-origin network targets and no credential exfiltration

Machine-learning content classifier returned a neutral/unknown category

Domain age information unavailable

Details

Page Title

502 Bad Gateway

Scan Type

public

Domain Name Analysis

The domain name 'objectstorage.ap-sydney-1.oraclecloud.com' uses the commercial generic top-level domain (.com) and includes subdomain 'objectstorage.ap-sydney-1'. Its registrable label 'oraclecloud' stretches across 11 characters holding 5 vowels versus 6 consonants. Splitting it apart reveals two words: oracle, cloud. The median word length lands at 5.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.89s

Total Load Time

7 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:17 chars

Detector Agreement:0%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	134.70.92.3Oracle · CLOUD	Bungarribee, New South Wales, Australia	AS31898Oracle Corporation
1	172.232.140.122	Stockholm, Stockholm County, Sweden	AS63949Akamai Connected Cloud
3	2	-	-