Security Scan Report: docusign.frank-zhang.com

Submitted: Completed: publiccompleted
This website contacted 5 IPs in 1 country across 2 domains to perform 8 HTTP transactions. The main domain is frank-zhang.com and was registered 6 months ago.

Submitted URL: https://docusign.frank-zhang.com/

AI Security Verdict

High Risk

Confidence: 58%

7
Risk Score

DocuSign-styled e-sign utility on a personal subdomain using the DocuSign name, with a passcode-only gate and PDF upload; no malware, exfiltration or threat-intel hits, but brand misuse and an orphan password field warrant caution.

Risk Factors (4)
Brand-name subdomain impersonating DocuSign on an unrelated personal domain
Password field with no accompanying username/email field ('master passcode' gate)
Unranked domain with minimal legitimacy signals (legitimacy score 10/100)
Document-upload/recipient workflow presented under an e-signature brand look-alike
Domain age information unavailable

Details

Page Title

DocuSign-Style E-Sign Sender (Multi-PDF)

Scan Type

public

Domain Name Analysis

The domain 'docusign.frank-zhang.com' uses the commercial generic top-level domain (.com) with subdomain 'docusign'. The registrable portion 'frank-zhang' spans 11 characters containing two vowels alongside 8 consonants; bonus characters include one hyphen. Word splitting yields 2 words: frank, zhang. Expect five characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

E-Sign Security Portal Enter master passcode to unlock system access | Enter Passcode |

Page Load Overview

0.81s
Total Load Time
236 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:603 chars
Detector Agreement:67%

Website Classification

Primary Category

documentation technical53% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

documentation technical
53%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4172.67.200.121Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.26.3.143Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.21.58.48Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.26.2.143Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.67.68.11Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
85--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16F231D1936B2003B5D9380FEF663AB59762A61C3ED16C6E5B98D42006FC7EB24DDB344

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:FK0TdEhni3mR9aUPk3kMljblnEWsZwwx/S:I0uhi8c35ljJOwwx/S

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:47409:B4HAahBAOZyZCmwkRsAFAS0CAxgAJEB6AgDIwQXwiASAAoFENiHVCtqApiCAQnicgBchMoEFDA4AgE0kg1IKGxZYCoyAAwJK

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000181818180000
Perceptual Hash:99996367cccc4c63
Difference Hash:324cb2b2b2b24c30
Wavelet Hash:c0c0d8d8d8d8c0fc
Color Hash:N/A

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data