Security Scan Report: docusign-cz3.pages.dev

Site favicon
Submitted: Completed: publiccompleted
This website contacted 8 IPs in 1 country across 6 domains to perform 13 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://docusign-cz3.pages.dev/

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

DocuSign-branded sign-in portal hosted on an unrelated pages.dev subdomain with no legitimate tie to DocuSign — brand impersonation, despite no form fields being captured.

Risk Factors (4)
Impersonation of DocuSign branding on a non-official domain
Suspicious brand-matching subdomain on a public hosting platform (pages.dev)
Sign-in / secure-portal framing designed to look like a trusted e-signature service
Unranked, zero-reputation host inconsistent with the claimed brand
Domain age information unavailable

Details

Page Title

Docusign Secure Sign-in

Scan Type

public

Domain Name Analysis

The domain name 'docusign-cz3.pages.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'docusign-cz3'. The registrable portion 'pages' spans 5 characters split between two vowels and three consonants. Breaking it apart gives one word: pages. Median word length comes out to five characters. No strong language cues emerged from the frequency lists.

Screenshot

Docusign Secure Portal "3 verifying... countrane . aor * Hep

Page Load Overview

0.45s
Total Load Time
2.0 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:51 chars
Detector Agreement:81%

All Detected Languages

🇺🇸en(81%)🇷🇴ro(19%)

Website Classification

Primary Category

government public service43% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

government public service
43%
news media journalism
41%
healthcare medical
40%
finance banking
31%
education learning
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.66.44.226Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.250.154.95Google · CDNUnited States
AS15169Google LLC
1104.16.80.73Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.94.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.13.94Google · CDNUnited States
AS15169Google LLC
1172.66.47.30Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.16.79.73Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
138--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1344186CB98E301463603D5982773570A3A92D007C58DD8743E4D52AC9FDE2E8C99778C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:nnWAa9fACBl7+tJca7EN6LQs8MaseZnC05G:nn2J1Bl7+tJcaonQe5CAG

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:2244:AAAABAAAAAAAAABUBBBACAhAQMACABgAAQBAAEKCAEAAAAABAAgAAgECAAAAAgIACAAAQgCAEAABAAAgAgABAgAAjAgAiAAA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fefefefee6e6fefe
Perceptual Hash:f7dc8c7322cc8833
Difference Hash:0202022a4c0e1202
Wavelet Hash:0e0e0e06061e0c0c
Color Hash:070000001c0

Other Hashes

Crop Resistant:0202022a4c0e1202

Scan History

Scan history not available

Unable to load historical scan data