ScanMalware.com

Security Scan Report: followalicedown.com

Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/b37c3ae8-a083-4296-94fc-d358113d8ca2Domain and IP registration (RDAP)/api/v1/rdap/b37c3ae8-a083-4296-94fc-d358113d8ca2How often this domain was scanned/api/v1/domain/stats/followalicedown.comScan history for this domain/api/v1/domain/history/followalicedown.com?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 1 HTTP transaction. The main domain is followalicedown.com and was registered 2 years 1 month ago.

Submitted URL: https://followalicedown.com/DocuSign-cPanel/

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Fake DocuSign page on followalicedown.com pushing a 'DocuSign ScreenConnect' installer with spoofed security footers and expiry countdowns — a malware/RAT lure, not DocuSign. Do not download or run anything.

Risk Factors (5)
Brand impersonation of DocuSign on an unrelated domain
Directs users to download an executable remote-support client from the page
Fake anti-bot / 'verify you are human' gate used to launder a malicious download
Spoofed security indicators (fake Ray ID, '256-bit SSL', 'Tamper-evident seals', footer attributed to DocuSign)
Non-brand URL path and mismatched publisher/email identity
Domain age information unavailable

Details

Page Title

DocuSign - Secure Document

Scan Type

public

Domain Name Analysis

Domain 'followalicedown.com' uses the commercial generic top-level domain (.com) without a subdomain. The registrable portion 'followalicedown' spans 15 characters with six vowels and nine consonants. Breaking it apart gives three words: follow, alice, down. Average segment length settles at five characters. No strong language cues emerged from the frequency lists.

Screenshot

a DocuSign Verify you are human by completing the action below. Verity you are human Docusign Security Click the checkbox to confirm you are human. DocuSign needs to review uriy of your connectio...

Page Load Overview

1.24s
Total Load Time
92 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:3,741 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software30% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
30%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1136.0.111.42United States
AS40676Psychz Networks
11--

Detected Technologies3

Cloudflare
50%
HTTP/3
40%
Cloudflare Bot Management
30%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1B6249E6756F3081A281741A97FBA2F567762D003D01AC8B57EEC67488F85BC5A4B33EC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:AupnIAuStOiNy1eLv2Bcl60tyxkACgdXY0/21IAVi:VnIAuSRy1eLv2AtZ+XY8LN

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:217210:QSoBNjiRrAJAQQMAgoaI2gEAYWiiYWiNUCKqyIIrw2gChnm4EAIQUkBDlGQGYqgGwCAARC6SBcZUQjxwqgkVwIIGIIRJELUA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:cfffc7c3cfefffcf
Perceptual Hash:b17c9cdc313438cd
Difference Hash:b0400c9c10082018
Wavelet Hash:dcfcd4c0c0f0f0c0
Color Hash:N/A

Other Hashes

Crop Resistant:b0400c9c10082018

Scan History

Scan history not available

Unable to load historical scan data