docusignature-firmar[.]github[.]io

PhishDestroy identifies docusignature-firmar.github.io as a credential theft domain actively impersonating DocuSign, a widely trusted electronic signature platform. This site is designed to trick users into submitting sensitive login credentials under the guise of a legitimate DocuSign service. The domain leverages GitHub Pages hosting and a Let's Encrypt SSL certificate to appear authentic, masking its malicious intent behind a seemingly reputable infrastructure.

This domain was flagged with a generic phishing threat type and poses significant risks to users who may unknowingly disclose their DocuSign account credentials. Technical indicators include registration through GitHub Pages, an SSL certificate issued by Let's Encrypt, and resolution to IP address 185.199.108.153. Critically, VirusTotal currently reports 0 detections out of 95 security engines, indicating that this threat has not yet been widely recognized or blocked by automated systems. The lack of detections, combined with the use of a legitimate hosting provider like GitHub, suggests a sophisticated approach to evading detection while targeting unsuspecting users.

If you have visited docusignature-firmar.github.io and entered any credentials, immediately change your DocuSign password and enable multi-factor authentication on your account. Additionally, scan your device for malware using reputable antivirus software, as attackers may have deployed keyloggers or other malicious payloads. Monitor your DocuSign account for any unauthorized activity and report suspicious transactions or login attempts to DocuSign support. Avoid interacting with this domain further and consider using bookmarked links or verified URLs to access DocuSign services in the future.