Security Report: docusign-v2review.vercel.app - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ad99c3fb-de7a-4b19-b9a0-db67a766a9ac Domain and IP registration (RDAP)/api/v1/rdap/ad99c3fb-de7a-4b19-b9a0-db67a766a9acHow often this domain was scanned/api/v1/domain/stats/docusign-v2review.vercel.app Scan history for this domain/api/v1/domain/history/docusign-v2review.vercel.app?limit=15

This website contacted 6 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: https://docusign-v2review.vercel.app/

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Fake DocuSign page on vercel.app using a spoofed Cloudflare check to push a Docusign_installer.zip download; embedded Telegram bot token enables data exfiltration. Brand impersonation plus malware delivery — do not download or interact.

Risk Factors (6)

Impersonation of DocuSign branding on a non-official, unranked vercel.app subdomain

Distribution of an installer archive (Docusign_installer.zip) presented as a required security/browser update

Urgency and fake update pressure ('Your DocuSign Client is Out of Date', 10-second countdown)

Telegram bot token in page JavaScript enabling exfiltration of victim data

Obfuscated brand imitation of Cloudflare in the 'human verification' gate

Network IDS flagged actor-abused cloud hosting (vercel.app) in DNS query and TLS SNI

Domain age information unavailable

Details

Page Title

DocuSign - Secure Document

Scan Type

public

Domain Name Analysis

You're looking at domain 'docusign-v2review.vercel.app' on the application-focused generic top-level domain (.app); it also runs on subdomain 'docusign-v2review'. Its registrable label 'vercel' stretches across 6 characters split between two vowels and four consonants. Word splitting yields 2 words: ver, cel. Expect 3 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

@ Security Check Verify you are human to continue. Verity you are human Cloudtare verification Click the checkbox to confirm you are human. This security check protects against automated access....

Page Load Overview

0.45s

Total Load Time

29 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:6,627 chars

Detector Agreement:100%

Website Classification

Primary Category

government public service32% confidence

Type: static

Method: ml+structural+ocr_tiebreaker

All Detected Categories

government public service

32%

healthcare medical

28%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
5	216.198.79.3Aws · CLOUD	United States	AS16509Amazon.com, Inc.
0	216.198.79.195Aws · CLOUD	United States	AS16509Amazon.com, Inc.
0	64.29.17.3Aws · CLOUD	United States	AS16509Amazon.com, Inc.
0	104.26.12.205Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	104.26.9.44Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
0	149.154.166.110	Amsterdam, North Holland, Netherlands	AS62041Telegram Messenger Inc
5	6	-	-