Windows Analysis Report
https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8

• EGA enabled

```json
{
  "contains_trigger_text": true,
  "trigger_text": "Please read the Electronic Record and Signature Disclosure",
  "prominent_button_name": "CONTINUE",
  "text_input_field_labels": [
    "Signature",
    "Initial",
    "Stamp",
    "Date Signed",
    "Name",
    "First Name",
    "Last Name",
    "Email Address",
    "Company",
    "Title",
    "Text",
    "Checkbox"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "brands": [
    "Docusign"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The brand 'Docusign' is well-known and typically associated with the domain 'docusign.com'.",    "The URL 'na4.docusign.net' uses a subdomain of 'docusign.net', which is a legitimate domain associated with Docusign services.",    "The use of subdomains like 'na4' is common for service providers to manage regional or service-specific instances.",    "The input fields are typical for a document signing service, which aligns with Docusign's offerings."  ],  "riskscore": 1}

URL: na4.docusign.net
            Brands: Docusign
            Input Fields: Signature, Initial, Stamp, Date Signed, Name, First Name, Last Name, Email Address, Company, Title, Text, Checkbox

```json
{
  "contains_trigger_text": true,
  "trigger_text": "Sign in",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email, phone, or Skype"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "contains_trigger_text": true,
  "trigger_text": "Sign in",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email, phone, or Skype"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}

```json
{
  "brands": [
    "Microsoft"
  ]
}

```json
{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The URL 'ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev' does not match the legitimate domain 'microsoft.com'.",    "The URL contains suspicious elements such as misspellings ('ciient' instead of 'client', '1ndex' instead of 'index', 'authonilne' instead of 'authonline').",    "The use of 'secure-protect-docs-ms' is misleading and attempts to mimic Microsoft-related services.",    "The domain extension '.workers.dev' is unusual for Microsoft and not typically associated with their official services.",    "The presence of input fields for 'Email, phone, or Skype' is common in phishing attempts targeting Microsoft accounts."  ],  "riskscore": 9}
Google indexed: False

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The URL 'ciient-1ndexauthonilne.secure-protect-docs-ms.workers.dev' does not match the legitimate domain 'microsoft.com'.",    "The URL contains suspicious elements such as misspellings ('ciient' instead of 'client', '1ndex' instead of 'index', 'authonilne' instead of 'authonline').",    "The use of 'secure-protect-docs-ms' is misleading and attempts to mimic Microsoft-related services.",    "The domain extension '.workers.dev' is unusual for Microsoft and suggests a potential phishing attempt.",    "The presence of input fields for 'Email, phone, or Skype' aligns with common phishing tactics to harvest personal information."  ],  "riskscore": 9}
Google indexed: False