Security Scan: Accessing Secure Document...

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/c18da0ad-9860-4f46-99d9-2b0772788434 Domain and IP registration (RDAP)/api/v1/rdap/c18da0ad-9860-4f46-99d9-2b0772788434 Certificate Transparency/api/v1/ct/login.sicdoc.com How often this domain was scanned/api/v1/domain/stats/pub-89a986e9207f48d4823d71b177f7ade5.r2.dev Scan history for this domain/api/v1/domain/history/pub-89a986e9207f48d4823d71b177f7ade5.r2.dev?limit=15

This website contacted 6 IPs in 1 country across 4 domains to perform 19 HTTP transactions. The main domain is login.sicdoc.com and was registered 9 years ago.

Submitted URL: https://pub-89a986e9207f48d4823d71b177f7ade5.r2.dev/secure.html#?doc72829=andlZ2VuZXJAZWRnZWZpZWxkLmsxMi5zYy51cw==

Effective URL:

https://login.sicdoc.com/uGUOlGie#[email protected]

Redirected

AI Security Verdict

Moderate Risk

Confidence: 88%

Risk Score

Fake DocuSign 'secure document' page on a Cloudflare R2 bucket that carries a base64 victim email token and redirects to login.sicdoc.com — a targeted credential-phishing chain. Do not interact.

Risk Factors (6)

DocuSign brand impersonation on an unrelated R2 public bucket host

Victim email encoded in base64 in the URL (phishing-kit tracking token)

Victim email in plaintext in the redirect fragment

Redirect from a generic r2.dev bucket to a login-named domain (login.sicdoc.com)

2 eval() calls and heavy DOM manipulation consistent with a multi-stage phishing kit loader

Obfuscated random path token (/uGUOlGie) typical of unique-per-victim phishing URLs

Safety Factors (1)

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 9 to 3

Domain age information unavailable

Details

Page Title

Accessing Secure Document...

Scan Type

public

Domain Name Analysis

Domain 'pub-89a986e9207f48d4823d71b177f7ade5.r2.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'pub-89a986e9207f48d4823d71b177f7ade5'. Count 2 characters in 'r2' with zero vowels and 1 consonant; it also includes one digit. It segments into 2 words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.69s

Total Load Time

2.1 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en-US

Text Length:185 chars

Detector Agreement:100%

Website Classification

Primary Category

documentation technical59% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

documentation technical

59%

government public service

29%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
4	104.18.50.34Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	98.93.12.231Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
3	104.18.54.45	United States	AS13335Cloudflare, Inc.
3	104.18.94.41Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	13.33.187.25Cloudfront · CDN	New York, New York, United States	AS16509Amazon.com, Inc.
3	104.18.95.41Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
19	6	-	-