docusign-jn7[.]relbilling-reltdz-com-s-account[.]workers[.]dev

The domain docusign-jn7.relbilling-reltdz-com-s-account.workers.dev is an active, high-risk credential phishing threat currently impersonating DocuSign. This domain is designed to steal login credentials from unsuspecting users by mimicking a legitimate DocuSign authentication page. As of the latest analysis, the domain remains live and operational, posing an ongoing risk to individuals and organizations.

Technical analysis reveals that this domain was created on April 3, 2026, and is registered through Cloudflare Workers, a service that can be abused for rapid deployment of phishing sites. The domain resolves to IP address 104.21.50.77 and uses a Let's Encrypt SSL certificate (E7) to appear legitimate. VirusTotal flags it as malicious by 6 out of 95 security vendors, and it appears on one security blocklist. The page title displayed is "Worker threw exception | docusign-jn7.relbilling-reltdz-com-s-account.workers.dev | Cloudflare," indicating a potential error or deliberate obfuscation.

The domain remains active and is a serious threat. Users who encounter this domain should not enter any credentials or personal information. PhishDestroy recommends verifying any suspicious links by checking the official DocuSign website directly. Organizations should block this domain at the network level and educate users about credential phishing tactics. If credentials have been entered, they should be changed immediately and IT security notified.