docu-singature[.]github[.]io

PhishDestroy identifies docu-singature.github.io as an active fake DocuSign signature portal designed to harvest user credentials. The threat level is currently under investigation but carries high risk due to its deceptive nature and active status. This domain leverages the trusted GitHub Pages infrastructure to appear legitimate, luring victims into entering sensitive login details under false pretenses. The site exploits the well-known DocuSign brand, a leading electronic signature service, to increase the likelihood of user engagement and credential theft.

This domain was flagged with a specific threat type: fake DocuSign phishing portal. Technical indicators include a resolution to IP address 185.199.109.153, a Let's Encrypt SSL certificate for perceived legitimacy, and registration through GitHub, Inc., hosting the site on GitHub Pages. As of the latest scan, VirusTotal reports 12 out of 95 security engines detecting malicious activity, indicating it has not yet been widely blacklisted. The domain's use of GitHub Pages as a hosting platform complicates initial detection, as GitHub is generally trusted. No current blocklist entries or trust score reductions were found, leaving users vulnerable to this subtle impersonation attack.

To mitigate this threat, users should avoid interacting with unsolicited signature requests or links claiming to be from DocuSign, especially those hosted on third-party domains like GitHub Pages. Verify any document requests directly through DocuSign’s official website or app, and never enter credentials on unfamiliar pages. Organizations should implement email filtering rules to block domains mimicking DocuSign and educate employees on recognizing phishing tactics using brand impersonation. Report any suspected phishing attempts to DocuSign and relevant cybersecurity authorities to aid in blocking efforts. The seed 5325e7 confirms the uniqueness of this assessment.