web-doce-exdus[.]pages[.]dev

PhishDestroy identifies web-doce-exdus.pages.dev as a confirmed phishing site impersonating DocuSign’s official platform. This domain employs a sophisticated document-themed phishing lure to trick users into divulging sensitive credentials or downloading malicious payloads. The infrastructure leverages a deceptive domain structure to evade detection, targeting victims through social engineering tactics disguised as legitimate document workflows. This domain resolves to IP address 188.114.97.3 and operates under a Cloudflare, Inc. registration with an SSL certificate issued by Google Trust Services. VirusTotal analysis currently shows 0 detections out of 95 engines, indicating low immediate detection but high potential risk. As of the investigation seed f5bc28, the domain remains unflagged on major blocklists, highlighting the need for proactive monitoring and user vigilance. Web-doce-exdus.pages.dev is categorized as an active phishing threat with a status of under investigation. Immediate response actions include domain takedown coordination with Cloudflare and SSL provider notifications. While technical indicators show low detection coverage, the absence of blocklist entries does not guarantee safety. Users are strongly advised to avoid interacting with this domain and report any suspicious activities immediately.