ScanMalware.com

Security Scan Report: docusign-6gn.jhallman.workers.dev

Site favicon
Submitted: Oct 1, 2026, 9:18:17 AMCompleted: Oct 1, 2026, 9:19:23 AMpubliccompleted

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Confirmed DocuSign phishing kit on a Cloudflare Workers subdomain — EvilTokens Ghost Loader concealment plus device-code OAuth lure ('Continue to Microsoft') flagged by IDS as a phishing landing page.

Risk Factors (5)
Known malicious phishing kit (Cloudflare Workers device-code / EvilToken family) identified on page
EvilTokens_Ghost_Loader YARA match — obfuscated AES-GCM decryption loader concealing page content
Network IDS flagged the page as a generic device-code phishing landing page (HIGH)
Brand impersonation of DocuSign on a domain that is not docusign.com
Free, instantly-provisioned Cloudflare Workers subdomain with undeterminable page age; page itself shows a broken error state typical of a live/abandoned kit
Domain age information unavailable

Details

Page Title

DocuSign - Review Document

Scan Type

public

Domain Name Analysis

The domain 'docusign-6gn.jhallman.workers.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'docusign-6gn.jhallman'. The registrable portion 'workers' spans 7 characters split between two vowels and five consonants. Tokenizing the label suggests one word: workers. Median word length is 7 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://docusign-6gn.jhallman.workers.dev/f05446c0edcc5693

Page Load Overview

5.55s
Total Load Time
164 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:511 chars
Detector Agreement:67%

Website Classification

Primary Category

technology software56% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
56%
documentation technical
52%
cryptocurrency blockchain
47%
government public service
36%
corporate business
29%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4188.114.97.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
174.125.29.95Google · CDNUnited States
AS15169Google LLC
1142.251.13.94Google · CDNUnited States
AS15169Google LLC
1142.251.14.95Google · CDNUnited States
AS15169Google LLC
1188.114.96.9Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
85--

Detected Technologies3

HTTP/3
40%
Cloudflare Bot Management
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T110A29D326398283C757385E9B3B5779A3022C25BF6476104AD782B74C1CAD53AE7B7C8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:IKohGXX10YqKFJsTBuJhL61T6ncWwjbG6GghN8JTdmQ22uLAmaiU:/ocXlVqvTBuJojWOZNATdmQ22uLPaiU

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:21914:Cg7FBGoqoAAEhNES0wgARUg4AwJiGlLAxBiiZzCB14CiQIyjAIJQB4uDIcBmNBRCiIVullBDJAEVDgnUXEABCEozBLQRAYsA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffef1818180000
Perceptual Hash:999ca60c9e1c9e3e
Difference Hash:20041832a2300008
Wavelet Hash:ffffef5d18180000
Color Hash:#d22d7a

Other Hashes

Crop Resistant:20041832a2300008

Scan History

Scan history not available

Unable to load historical scan data