Security Scan Report: linking-authenticator-secured-profile.pages.dev

Site favicon
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 1 country across 3 domains to perform 13 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://linking-authenticator-secured-profile.pages.dev/

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

DocuSign/Microsoft-branded device-code phishing page on a pages.dev subdomain: it hands the victim a code to enter at microsoft.com/devicelogin, letting attackers steal Microsoft session tokens. Do not enter the code.

Risk Factors (6)
Impersonation of DocuSign and Microsoft brands on a domain that does not belong to either
Device-code phishing technique designed to steal Microsoft account access without a local credential form
Deceptive hostname combining 'linking-authenticator-secured-profile' with a shared pages.dev subdomain
Document-themed social engineering lure (fake NDA PDF) to pressure the victim into authenticating
Unranked domain on actor-abused cloud hosting infrastructure
Cross-origin fetch to an unrelated unranked vercel.app endpoint
Domain age information unavailable

Details

Page Title

DocuSign - Complete Secure Authentication

Scan Type

public

Domain Name Analysis

You're looking at domain 'linking-authenticator-secured-profile.pages.dev' on the developer-focused generic top-level domain (.dev) and includes subdomain 'linking-authenticator-secured-profile'. Count 5 characters in 'pages' with 2 vowels and 3 consonants. Splitting it apart reveals 1 word: pages. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://linking-authenticator-secured-profile.pages.dev/

Page Load Overview

0.55s
Total Load Time
24 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:800 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical55% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
55%
technology software
50%
corporate business
34%
government public service
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
5172.66.47.139Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2172.64.145.48Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
264.29.17.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2172.66.44.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2216.198.79.195Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
135--

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17662B5363347113BB7476CE03866C79BB1759A1BE947A1388AE85198C3DCDC4CA37788

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:A24W73rLiHdlQaG9ejOoAOnMUWpOGaJmdR4Jze2tV:A2Z3radlQaGEjOoAHUWpO9JWSfH

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:14700:QCRJIQ0SIsCGAQAAACrk0gABUAoWUIDuXUCQNArLxAhZANAKh1oIpsgCV8AoMsAkB7QAgQHBJcBIwuAaYkSCiUIAgARRyoUh

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00181818181c1818
Perceptual Hash:99196667734d4c66
Difference Hash:6970323270327169
Wavelet Hash:183c3c3c3c3c3c3c
Color Hash:#3a785b

Scan History

Scan history not available

Unable to load historical scan data