Phishing sites impersonating Docusign

PhishDestroy has recorded 73 phishing domains impersonating Docusign since 2025-08-31, 7 of them in the last 30 days. The most used registrars are NICENIC and Squarespace Domains; the most common TLDs are .com and .icu. The official Docusign domain is docusign.com: any other site asking for your login or wallet is not Docusign.

73
Domains, all time
7
Last 30 days
26
Online at last check
3
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 22026-08-15: 82026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 12026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 22026-09-01: 02026-09-02: 02026-09-03: 12026-09-04: 02026-09-05: 52026-09-06: 12026-09-07: 02026-09-08: 02026-09-09: 12026-09-10: 02026-09-11: 12026-09-12: 02026-09-13: 02026-09-14: 12026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 32026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 12026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 12026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 22026-10-20: 02026-10-21: 02026-10-22: 0
Docusign phishing domains detected per day: 30 from 2026-07-25 to 2026-10-22; peak 8.

How to tell a fake Docusign site

Official domain: docusign.com.

Words most often added to the brand in reported domains: transcript, install, appwrite, documents, apps, complete, pdf, solution, successful, cpsess.

  • Type the address yourself or use a bookmark; phishing links for Docusign arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Docusign does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Docusign phishing domains

The 50 most recently detected domains impersonating Docusign
DomainFirst detectedStatus at last checkRegistrar
sign.documents.review.scann.store2026-10-19OnlineSquarespace Domains
mafeeial.info2026-10-19OfflineNameSilo
er.wpprja.com2026-10-13OfflineIONOS SE
install-grayinv-docu.icu2026-10-07UnknownNICENIC
install-topper-documents.icu2026-09-25UnknownNICENIC
transcript.strongholpayreviewpolicy.co2026-09-25OfflineDynadot
horusian.com2026-09-25OnlineGoDaddy.com
install-mew-documents.icu2026-09-14UnknownNICENIC
noreply-notification.icu2026-09-11UnknownNICENIC
strongholpayreviewpolicy.co2026-09-09OfflineDynadot
docusfilesdownloadhelper.info2026-09-06OfflineNameSilo
gudwa.com2026-09-05OnlineWebcentral
install-cpunks-documents.icu2026-09-05UnknownNICENIC
transcript.hathornetworkpolicyreview.com2026-09-05OfflineDynadot
hathornetworkpolicyreview.com2026-09-05OfflineDynadot
hy.iudxed.com2026-09-05OfflineIONOS SE
install-documentation.sbs2026-09-03UnknownNICENIC
doc-sign.live2026-08-31OfflineDynadot
transcript.bitboxswisspolicyreview.com2026-08-31UnknownNICENIC
aussieearners.com2026-08-20OnlineDYNADOT
transcript.coinfundpolicyreview.com2026-08-15OfflineSquarespace Domains
grvtdocusignsetup.icu2026-08-15UnknownNICENIC
docusignsetup.icu2026-08-15UnknownNICENIC
guiatotalbrasil.com2026-08-15OfflinePublicDomainRegistry.com
transcript.emurgopolicyreview.com2026-08-15OfflineSquarespace Domains
transcript.bnktothefuturepolicyreview.com2026-08-15OfflineSquarespace Domains
invite.go2omega.com2026-08-15OnlinePublicDomainRegistry.com
bwdocusignsetup.icu2026-08-15UnknownNICENIC
docusign.riberaturisme.es2026-08-14Online—
jojolandings.com2026-08-14OfflineTUCOWS.COM
maisonchristina.com2026-07-22OnlinePublicDomainRegistry.com
secure-page-builder--daklmk.replit.app2026-07-21OnlineReplit
helpdeskpilot.onrender.com2026-07-19OnlineRender Services
aspeducators.onrender.com2026-07-19OnlineRender Services
apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com2026-07-16OfflinePublicDomainRegistry.com
hvflexo.com2026-07-16OfflinePublicDomainRegistry.com
oj.jo2026-07-11Online—
sharedfile.morefilms.de2026-07-11Offline—
itechbyte.com.br2026-07-08Online—
cvmac.id2026-07-08OfflinePT Digital Registra Indonesia
useasoffer.com2026-06-30OnlineNAMECHEAP
docusign-authsign.com2026-06-28OfflineGlobal Domain
scooke-work.github.io2026-06-28OfflineGitHub
etspine.co.za2026-06-25OnlineAfrihost
houstontacolover.com2026-06-20OfflineNameCheap
familydine.icu2026-06-19OfflineNameSilo
policycompliancereview.com2026-06-16OfflineSquarespace Domains
dardsaaz.com2026-06-15OnlineNavicosoft
markatuna.com2026-06-14OfflineBluehost
docsonlineshare.shorepowersolution.net2026-06-13OfflineAmazon Registrar

All 73 Docusign reports

Where they are registered and hosted

Registrars

  1. NICENIC14
  2. Squarespace Domains8
  3. PublicDomainRegistry.com5
  4. Dynadot5
  5. GoDaddy.com4
  6. NameSilo3
  7. Appwrite2
  8. NameCheap2

Top-level domains

  1. .com37
  2. .icu9
  3. .network4
  4. .app3
  5. .es2
  6. .io2
  7. .info2
  8. .co2

Hosting networks

  1. Cloudflare, Inc.12
  2. Omegatech LTD9
  3. Amazon.com, Inc.7
  4. FASTLY - Fastly, Inc., US3
  5. AS13335 Cloudflare, Inc.3
  6. OMEGATECH-AS Omegatech LTD, SC3
  7. Fastly, Inc.2
  8. Oracle Corporation2

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Docusign; share of all PhishDestroy reports: 0.03%.