Security Report: baronnova.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/03d0065b-29ad-44d1-bcb4-046d12cff5d4 Domain and IP registration (RDAP)/api/v1/rdap/03d0065b-29ad-44d1-bcb4-046d12cff5d4How often this domain was scanned/api/v1/domain/stats/baronnova.com Scan history for this domain/api/v1/domain/history/baronnova.com?limit=15

This website contacted 5 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main domain is baronnova.com and was registered 2 months ago.

Submitted URL: https://baronnova.com/x/reference.html

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Fake DocuSign page on baronnova.com impersonating the brand and pushing users to download and run an executable; script contains a Telegram bot token for exfiltration. Do not click or run anything.

Risk Factors (6)

Impersonation of DocuSign brand on unrelated domain baronnova.com

Telegram bot token embedded in page script (exfiltration channel)

Directs user to download and execute a file to 'complete the form'

Critical IDS alert for Windows PE EXE/DLL download, plus packed executable and IsDebuggerPresent anti-debug alerts

Artificial 24-hour deadline and desktop-only requirement to pressure and evade analysis

Domain only 86 days old and unranked in Cisco Umbrella

Domain age information unavailable

Details

Page Title

DocuSign - Review and Sign Document

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'baronnova.com' is registered with no subdomain. The registrable portion 'baronnova' spans 9 characters holding 4 vowels versus 5 consonants. It segments into 2 words: baron, nova. Median word length is 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Docu Sign ° Professional_Reference_Request.pdf Document Reference: 2026-8821 ACTION REQUIRED Page 1 of 3 - Signature and acknowledgement required Review Request Reference Request Portal You have...

Page Load Overview

0.94s

Total Load Time

12 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:1,649 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical47% confidence

Type: static

Method: ml+structural+ocr_tiebreaker

All Detected Categories

documentation technical

47%

technology software

31%

government public service

30%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	172.67.69.226Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	149.154.166.110	Amsterdam, North Holland, Netherlands	AS62041Telegram Messenger Inc
1	104.26.9.44Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
7	5	-	-