Security Scan Report: static-website-environment--docu-sign-auth.replit.app

Site favicon
Submitted: Completed: publiccompleted

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Fake Microsoft sign-in on an unranked Replit subdomain that impersonates Microsoft, captures a password-only form, and ships data to a Telegram bot — confirmed credential phishing.

Risk Factors (5)
Brand impersonation of Microsoft on a non-Microsoft, unranked domain
Credential harvesting: password-only form with no username field
Telegram bot token in inline script enables exfiltration of captured input
Deceptive hostname namespace (docu-sign-auth) on shared free hosting
Sensitive-file/identity-verification pretext to induce credential entry
Domain age information unavailable

Details

Page Title

Microsoft | Login

Scan Type

public

Domain Name Analysis

You're looking at domain 'static-website-environment--docu-sign-auth.replit.app' on the application-focused generic top-level domain (.app), featuring subdomain 'static-website-environment--docu-sign-auth'. The registrable portion 'replit' spans 6 characters split between two vowels and 4 consonants. It segments into 2 words: rep, lit. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://static-website-environment--docu-sign-auth.replit.app/

Page Load Overview

1.81s
Total Load Time
793 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:437 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software38% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

technology software
38%
documentation technical
34%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
534.117.33.233Google · CDNKansas City, Missouri, United States
AS396982Google LLC
1142.251.14.95Google · CDNUnited States
AS15169Google LLC
1151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1172.67.142.245Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
113.107.246.44Azure · CLOUDUnited States
AS8075Microsoft Corporation
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
135.190.3.23Google · CDNKansas City, Missouri, United States
AS396982Google LLC
1195.80.159.133France
AS29152Decknet SARL
1151.101.193.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1612--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1D934431FE8F212991C43947817EA6BA57379C003CA19FDBA7D8E7354CF4E6848D62B48

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:Lfm0VHSXf28zNta3cjyHE9uc6BcgGk9Byf/MuSj+Yrj0YYM2pNhxQx/BuD:NSXeDuSj+Yrj0YY2x/BuD

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:242710:oh86OIaCMCDkIAIMHhMCOkEhJjAZQhBIMAghyADBCE4RQoCHWgqJA4My5JhQBZIAByikBkEgJQR8fXgMBUFiRBEUWWwGBtSC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:f8f8fcfebffb7f00
Perceptual Hash:c9cc41aa55a657b3
Difference Hash:e2d0983673c799d8
Wavelet Hash:f0f8fcda9d294d00
Color Hash:#6d1f93

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data