Security Report: docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/7c4ad624-5e89-4805-9aa3-56b2848bdf92 Domain and IP registration (RDAP)/api/v1/rdap/7c4ad624-5e89-4805-9aa3-56b2848bdf92 Certificate Transparency/api/v1/ct/docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev How often this domain was scanned/api/v1/domain/stats/docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev Scan history for this domain/api/v1/domain/history/docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev?limit=15

This website contacted 5 IPs in 1 country across 3 domains to perform 8 HTTP transactions. The main domain is docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev and was registered 18 years ago.

Submitted URL: https://docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev/c1f3f4af0aa29477

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

DocuSign-branded device-code phishing kit (EvilToken) on a disposable *.workers.dev subdomain, confirmed by kit-roster match, EvilTokens_Ghost_Loader YARA hit, and HIGH ET PHISHING device-code IDS alerts. Do not enter codes or authorise Microsoft sign-in.

Risk Factors (5)

Brand impersonation of DocuSign on a non-DocuSign domain

Known phishing kit (Cloudflare Workers device-code / EvilToken) identified by analyst-vetted roster

EvilTokens_Ghost_Loader YARA malware pattern in page script

HIGH IDS alerts for generic device-code phishing landing page

Disposable hosting-platform subdomain with random/gibberish namespace embedding an email-like string

Domain age information unavailable

Details

Page Title

DocuSign - Review Document

Scan Type

public

Favicon Hash

MMH3: 859591052

MD5: 40b7de74a4e3e4b3e59a5eb785a307bc

Domain Name Analysis

The domain 'docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'docusign-9vs.jhon1213488-outlook-com-s-account'. The second-level label 'workers' is 7 characters long with 2 vowels and 5 consonants. Splitting it apart reveals one word: workers. Median word length comes out to seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

2.52s

Total Load Time

164 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:511 chars

Detector Agreement:67%

Website Classification

Primary Category

technology software56% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

56%

documentation technical

52%

cryptocurrency blockchain

47%

government public service

36%

corporate business

29%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	172.67.182.149Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	74.125.29.95Google · CDN	United States	AS15169Google LLC
1	142.251.13.94Google · CDN	United States	AS15169Google LLC
1	104.21.36.4Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	142.251.14.95Google · CDN	United States	AS15169Google LLC
8	5	-	-