pxs[.]me

PhishDestroy identifies an active phishing domain, pxs.me, impersonating DocuSign PDF services with the goal of harvesting login credentials or delivering malware. The domain is currently classified under generic_phishing and remains active as of the latest intelligence. The threat vector specifically targets DocuSign document workflows, directing victims to false login portals to capture sensitive user data.

This domain was flagged by 1 of 95 VirusTotal vendors, indicating undetected malicious activity. It is registered through GoDaddy.com, LLC, resolves to IP 104.26.1.139, and holds a Let's Encrypt SSL certificate. The domain was created on February 07, 2013, indicating a long-standing but recently weaponized registration. Trust scores remain neutral due to zero detections, though behavioral anomaly suggests recent malicious deployment. There is no current listing on major blocklists such as URLVoid, OpenPhish, or PhishTank.

PhishDestroy assesses the risk as under investigation pending further behavioral analysis and takedown escalation. Users are strongly advised to block pxs.me at DNS and firewall levels. All employees accessing DocuSign should verify document URLs manually and enable multi-factor authentication. If any access occurred, reset passwords immediately and scan endpoints for unauthorized activity. Monitoring for lateral movement or data exfiltration is advised pending further intelligence updates.