Phishing detection: geotehnica.com

DocuSign
https://geotehnica.com/docusignreader Access site
Screenshot
Screenshot of geotehnica.com
Investigate
Domain geotehnica.com2 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 94.26.91.102
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://geotehnica.com/docusignreader
urlscan Wayback archive.today
Cert YR1
crt.sh Censys Google CT
Phishunt analysis Beta
17 noiseheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +3.0 OpenPhish
  • +2.2 Country mismatch
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.7 Unrecognised DNS provider
  • +0.6 Brand impersonation in path
  • +0.6 Registrar reputation
  • +0.5 Young certificate
  • +0.3 Free CA
  • +0.3 Long domain
  • +0.2 Suspicious TLD
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

DocuSign impersonation page embedded in an unrelated Bulgarian domain under a path designed to mimic a document reader. Flagged by OpenPhish. Likely harvests credentials from targets expecting a document signing link.

Brand impersonation in pathOpenPhishKeyword match
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-03 · confidence 75%
Domain & Network
Whois
Registrar OnlineNIC, Inc.
Network
IP 94.26.91.102
Country BulgariaBulgaria
Hosting Telco power Ltd
ASN AS48452
TLS Cert YR1
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-03 01:03 UTC  ·  Last refreshed 2026-09-18 21:30 UTC