WEBSITE ANALYSIS REPORT

https://docusign.login.adrpowersystem.com/

26 Aug 2026 · 21:27:53.000 UTCpublic

Report tags: phishing eviltokens aitm
Submit tags: openphish

Request review

Phishing detected

6 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

21:27:22.686 GET 200 document 13.3 KB 103 ms 5 alerts

21:27:23.209 GET 200 stylesheet 9.9 KB 86 ms —

21:27:23.219 POST 403 fetch 32 B 486 ms 5 alerts

Transaction #06

Request / response

URL

POST HTTPS

https://docusign.login.adrpowersystem.com/api/session/init

IP / ASN

172.67.192.62

AS13335 · CLOUDFLARENET

Requested by: https://docusign.login.adrpowersystem.com/

Resource information

File type: JSON text data
MIME type: application/json
First seen (UTC): 09 Jun 2026 · 09:28:53.061 UTC
Last seen (UTC): 10 Sep 2026 · 03:59:21.528 UTC
Times seen: 90

Size: 32 B (32 bytes)
MD5: e20b87312a8a7ded5f1556f3ec95deac
SHA1: ac4aa201129f1b6230ad569df63de588650361ea
SHA256: 9f816aa303d9a49c02f4338c6abf6648530d4df7610f6e788eafe7df5013b40b

Certificate information

Issuer: Google Trust Services · WE1
Subject: adrpowersystem.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 0E:1C:5A:B0:33:20:D1:88:3C:CA:0B:D4:C8:81:01:6A:F3:59:87:00
Valid from: Sun, 16 Aug 2026 09:13:58 GMT
Valid until: Sat, 14 Nov 2026 10:13:45 GMT

Technology fingerprints

Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - EvilTokens Phishing Kit	high	Phishing
Quad9 DNS Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious
OpenDNS Phishing Block	medium	Phishing

HTTP headers

Request headers

POST /api/session/init HTTP/1.1
Host: docusign.login.adrpowersystem.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://docusign.login.adrpowersystem.com/
X-Antibot-Token: 4f88f2f356c06be1d8f3b114dd1fd879d50048e8f6cc6a3e84b563c7b0852baa
Origin: https://docusign.login.adrpowersystem.com
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=4
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

Response headers

HTTP/3 403 
date: Wed, 26 Aug 2026 21:27:23 GMT
server-timing: cfExtPri
content-type: application/json
server: cloudflare
access-control-allow-origin: *
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XTimfx8cYMddigJn6PhB8TG6LEozlQaaoNZiJ3hWixQD3WUH46a4pJQ82QpEHq%2B3w%2FQw2ymGBHbR%2FSkOF77SFT1qu45%2FrwbUag%2BcDuLYWBtz9SjlMvS1emgX4nqEuk8%2Bu0lIdxjsuVDjxlLlTFUvGQUsrEY%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=4,i=?0
cf-ray: a315eb921ddd5691-OSL
alt-svc: h3=":443"; ma=86400
content-length: 32

21:27:23.223 GET 200 img 300.7 KB 479 ms —

21:27:23.322 GET 200 font 47.4 KB 68 ms —

21:27:23.728 GET 200 font 47.4 KB 20 ms —

https://docusign.login.adrpowersystem.com/

Domain graph

Hostnames

Connections

Network requests

Transaction #06

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://docusign.login.adrpowersystem.com/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #06

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://docusign.login.adrpowersystem.com/

Domain graph

Network requests