docusignmeetingteams[.]com

Analysis of docusignmeetingteams.com indicates a high-risk phishing domain targeting DocuSign users, active as of July 19, 2026. The domain was registered through HOSTINGER operations, UAB, and resolves to IP address 192.142.18.253, hosted by Ultahost Inc in the Netherlands. Infrastructure review shows Cloudflare nameservers (novalee.ns.cloudflare.com, rajeev.ns.cloudflare.com) and a 302 HTTP redirect status, a common tactic to obscure the final destination of phishing traffic. The SSL certificate is issued for edge-fallback.local, which does not match the domain and suggests automated or low-effort deployment. Three of 91 security vendors on VirusTotal have flagged this domain, and it appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. No specific phishing kit or payload has been confirmed in available data, but the domain name and targeting align with credential harvesting campaigns impersonating DocuSign meeting or document workflows. Defenders should treat this domain as malicious and block it at DNS, proxy, and endpoint layers. Further investigation into the redirect chain and any associated email or SMS campaigns is recommended to determine the full scope of the operation.