# Phishing sites impersonating Docusign PhishDestroy has recorded 73 phishing domains impersonating Docusign since 2025-08-31, 7 of them in the last 30 days. The most used registrars are NICENIC and Squarespace Domains; the most common TLDs are .com and .icu. The official Docusign domain is docusign.com: any other site asking for your login or wallet is not Docusign. 73Domains, all time 7Last 30 days 26Online at last check 3Confirmed takedowns ## New domains in the last 90 days Docusign phishing domains detected per day: 30 from 2026-07-25 to 2026-10-22; peak 8. ## How to tell a fake Docusign site Official domain: docusign.com. Words most often added to the brand in reported domains: transcript, install, appwrite, documents, apps, complete, pdf, solution, successful, cpsess. - Type the address yourself or use a bookmark; phishing links for Docusign arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Docusign does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Docusign phishing domains The 50 most recently detected domains impersonating Docusign Domain | First detected | Status at last check | Registrar | [sign.documents.review.scann.store](https://phishdestroy.io/domain/sign.documents.review.scann.store/) | 2026-10-19 | Online | Squarespace Domains | [mafeeial.info](https://phishdestroy.io/domain/mafeeial.info/) | 2026-10-19 | Offline | NameSilo | [er.wpprja.com](https://phishdestroy.io/domain/er.wpprja.com/) | 2026-10-13 | Offline | IONOS SE | [install-grayinv-docu.icu](https://phishdestroy.io/domain/install-grayinv-docu.icu/) | 2026-10-07 | Unknown | NICENIC | [install-topper-documents.icu](https://phishdestroy.io/domain/install-topper-documents.icu/) | 2026-09-25 | Unknown | NICENIC | [transcript.strongholpayreviewpolicy.co](https://phishdestroy.io/domain/transcript.strongholpayreviewpolicy.co/) | 2026-09-25 | Offline | Dynadot | [horusian.com](https://phishdestroy.io/domain/horusian.com/) | 2026-09-25 | Online | GoDaddy.com | [install-mew-documents.icu](https://phishdestroy.io/domain/install-mew-documents.icu/) | 2026-09-14 | Unknown | NICENIC | [noreply-notification.icu](https://phishdestroy.io/domain/noreply-notification.icu/) | 2026-09-11 | Unknown | NICENIC | [strongholpayreviewpolicy.co](https://phishdestroy.io/domain/strongholpayreviewpolicy.co/) | 2026-09-09 | Offline | Dynadot | [docusfilesdownloadhelper.info](https://phishdestroy.io/domain/docusfilesdownloadhelper.info/) | 2026-09-06 | Offline | NameSilo | [gudwa.com](https://phishdestroy.io/domain/gudwa.com/) | 2026-09-05 | Online | Webcentral | [install-cpunks-documents.icu](https://phishdestroy.io/domain/install-cpunks-documents.icu/) | 2026-09-05 | Unknown | NICENIC | [transcript.hathornetworkpolicyreview.com](https://phishdestroy.io/domain/transcript.hathornetworkpolicyreview.com/) | 2026-09-05 | Offline | Dynadot | [hathornetworkpolicyreview.com](https://phishdestroy.io/domain/hathornetworkpolicyreview.com/) | 2026-09-05 | Offline | Dynadot | [hy.iudxed.com](https://phishdestroy.io/domain/hy.iudxed.com/) | 2026-09-05 | Offline | IONOS SE | [install-documentation.sbs](https://phishdestroy.io/domain/install-documentation.sbs/) | 2026-09-03 | Unknown | NICENIC | [doc-sign.live](https://phishdestroy.io/domain/doc-sign.live/) | 2026-08-31 | Offline | Dynadot | [transcript.bitboxswisspolicyreview.com](https://phishdestroy.io/domain/transcript.bitboxswisspolicyreview.com/) | 2026-08-31 | Unknown | NICENIC | [aussieearners.com](https://phishdestroy.io/domain/aussieearners.com/) | 2026-08-20 | Online | DYNADOT | [transcript.coinfundpolicyreview.com](https://phishdestroy.io/domain/transcript.coinfundpolicyreview.com/) | 2026-08-15 | Offline | Squarespace Domains | [grvtdocusignsetup.icu](https://phishdestroy.io/domain/grvtdocusignsetup.icu/) | 2026-08-15 | Unknown | NICENIC | [docusignsetup.icu](https://phishdestroy.io/domain/docusignsetup.icu/) | 2026-08-15 | Unknown | NICENIC | [guiatotalbrasil.com](https://phishdestroy.io/domain/guiatotalbrasil.com/) | 2026-08-15 | Offline | PublicDomainRegistry.com | [transcript.emurgopolicyreview.com](https://phishdestroy.io/domain/transcript.emurgopolicyreview.com/) | 2026-08-15 | Offline | Squarespace Domains | [transcript.bnktothefuturepolicyreview.com](https://phishdestroy.io/domain/transcript.bnktothefuturepolicyreview.com/) | 2026-08-15 | Offline | Squarespace Domains | [invite.go2omega.com](https://phishdestroy.io/domain/invite.go2omega.com/) | 2026-08-15 | Online | PublicDomainRegistry.com | [bwdocusignsetup.icu](https://phishdestroy.io/domain/bwdocusignsetup.icu/) | 2026-08-15 | Unknown | NICENIC | [docusign.riberaturisme.es](https://phishdestroy.io/domain/docusign.riberaturisme.es/) | 2026-08-14 | Online | — | [jojolandings.com](https://phishdestroy.io/domain/jojolandings.com/) | 2026-08-14 | Offline | TUCOWS.COM | [maisonchristina.com](https://phishdestroy.io/domain/maisonchristina.com/) | 2026-07-22 | Online | PublicDomainRegistry.com | [secure-page-builder--daklmk.replit.app](https://phishdestroy.io/domain/secure-page-builder--daklmk.replit.app/) | 2026-07-21 | Online | Replit | [helpdeskpilot.onrender.com](https://phishdestroy.io/domain/helpdeskpilot.onrender.com/) | 2026-07-19 | Online | Render Services | [aspeducators.onrender.com](https://phishdestroy.io/domain/aspeducators.onrender.com/) | 2026-07-19 | Online | Render Services | [apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com](https://phishdestroy.io/domain/apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/) | 2026-07-16 | Offline | PublicDomainRegistry.com | [hvflexo.com](https://phishdestroy.io/domain/hvflexo.com/) | 2026-07-16 | Offline | PublicDomainRegistry.com | [oj.jo](https://phishdestroy.io/domain/oj.jo/) | 2026-07-11 | Online | — | [sharedfile.morefilms.de](https://phishdestroy.io/domain/sharedfile.morefilms.de/) | 2026-07-11 | Offline | — | [itechbyte.com.br](https://phishdestroy.io/domain/itechbyte.com.br/) | 2026-07-08 | Online | — | [cvmac.id](https://phishdestroy.io/domain/cvmac.id/) | 2026-07-08 | Offline | PT Digital Registra Indonesia | [useasoffer.com](https://phishdestroy.io/domain/useasoffer.com/) | 2026-06-30 | Online | NAMECHEAP | [docusign-authsign.com](https://phishdestroy.io/domain/docusign-authsign.com/) | 2026-06-28 | Offline | Global Domain | [scooke-work.github.io](https://phishdestroy.io/domain/scooke-work.github.io/) | 2026-06-28 | Offline | GitHub | [etspine.co.za](https://phishdestroy.io/domain/etspine.co.za/) | 2026-06-25 | Online | Afrihost | [houstontacolover.com](https://phishdestroy.io/domain/houstontacolover.com/) | 2026-06-20 | Offline | NameCheap | [familydine.icu](https://phishdestroy.io/domain/familydine.icu/) | 2026-06-19 | Offline | NameSilo | [policycompliancereview.com](https://phishdestroy.io/domain/policycompliancereview.com/) | 2026-06-16 | Offline | Squarespace Domains | [dardsaaz.com](https://phishdestroy.io/domain/dardsaaz.com/) | 2026-06-15 | Online | Navicosoft | [markatuna.com](https://phishdestroy.io/domain/markatuna.com/) | 2026-06-14 | Offline | Bluehost | [docsonlineshare.shorepowersolution.net](https://phishdestroy.io/domain/docsonlineshare.shorepowersolution.net/) | 2026-06-13 | Offline | Amazon Registrar | [All 73 Docusign reports](https://phishdestroy.io/domain/?brand=Docusign) ## Where they are registered and hosted ### Registrars - [NICENIC](https://phishdestroy.io/registrar/nicenic/)14 - [Squarespace Domains](https://phishdestroy.io/registrar/squarespace/)8 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)5 - [Dynadot](https://phishdestroy.io/registrar/dynadot/)5 - [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)4 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)3 - Appwrite2 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)2 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)37 - [.icu](https://phishdestroy.io/tld/icu/)9 - [.network](https://phishdestroy.io/tld/network/)4 - [.app](https://phishdestroy.io/tld/app/)3 - [.es](https://phishdestroy.io/tld/es/)2 - [.io](https://phishdestroy.io/tld/io/)2 - [.info](https://phishdestroy.io/tld/info/)2 - [.co](https://phishdestroy.io/tld/co/)2 ### Hosting networks - Cloudflare, Inc.12 - Omegatech LTD9 - Amazon.com, Inc.7 - FASTLY - Fastly, Inc., US3 - AS13335 Cloudflare, Inc.3 - OMEGATECH-AS Omegatech LTD, SC3 - Fastly, Inc.2 - Oracle Corporation2 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Docusign; share of all PhishDestroy reports: 0.03%. Canonical: https://phishdestroy.io/brand/docusign/