Domain security and threat intelligence
documentsignatures.appwrite.network
“Docusign Login - Enter email to start sign in”
Threat verdict
Critical
95/100 evidence score
Availability
Reachable · access restricted
Reachable response; page content was not verified
Risk signals
VirusTotal detections: 10/91
URLQuery threat systems: 6 alerts
Brand impersonation: DocuSign
Last known active
Actions
API
ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@fastly.com.
The latest stored availability evidence still shows the domain reachable; 7 months has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
Elapsed since first report
7 months
Reports sent
1
Latest case ID
PD-20260221-DB6F63
Current status
HTTP 403 at latest stored check
Evidence Summary
CRITICAL
The domain documentsignatures.appwrite.network was registered through GoDaddy.com, LLC on February 21, 2026 and is actively resolving to the IP address 151.101.67.52, which belongs to the Fastly, Inc. network (AS54113) in the United States. The site presents a page title of "Docusign Login - Enter email to start sign in," directly referencing the DocuSign brand and confirming a credential‑phishing intent. VirusTotal analysis shows that 18 of 95 security vendors have flagged the domain, providing a multi‑engine consensus that the host is malicious. The SSL certificate in use is identified as "Certainly / Certainly Intermediate R1," and the HTTP response for the root path returns a 403 status code, indicating that direct access is denied while the phishing content may be served from a different endpoint.
A Gridinsoft trust score of 0 out of 100 further underscores the lack of legitimacy. The domain is currently listed on one external security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one dedicated phishing mitigation platform has recognized it as hostile. Infrastructure analysis reveals the presence of Varnish, a caching layer commonly employed to accelerate content delivery for malicious actors operating behind CDN services. While the page title and vendor detections confirm a credential‑phishing campaign targeting DocuSign users, the precise content of the page beyond the title has not been publicly disclosed, leaving the full scope of data collection techniques uncertain.
Defenders should immediately add documentsignatures.appwrite.network to firewall and proxy deny lists, monitor DNS queries for the associated IP, and enforce multi‑factor authentication for all DocuSign accounts. Security teams are advised to update endpoint protection signatures to include the 18 vendor detections and to educate users about unsolicited DocuSign login prompts that reference this domain.
VirusTotal
10 det.
URLQuery
6 threat alerts
CF Radar
Malicious
URLScan
TLS Certificate
Certainly Intermediate R1 21d
Age
7 mo
Observed status
Reachable · access restricted 403
DestroyList
Listed
Reports Sent
1
Data coverage
VirusTotal
10 / 91
URLQuery
6 threat-system alerts
PhishStats
checked — no match recorded
OTX
no community references
CF Radar
provider verdict: malicious
URLScan capture
stored report
TLS
valid certificate, 21d
WHOIS
7 mo old
Screenshot
3 captures · 3 sources
Network Security Intelligence
Threat Detection Systems
6 alerts
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| DigiCert UltraDNS | documentsignatures.appwrite.network |
malicious | Sinkholed |
| OpenDNS | documentsignatures.appwrite.network |
phishing | Phishing Block |
| DNS4EU | documentsignatures.appwrite.network |
malicious | Sinkholed |
| Cloudflare DNS | documentsignatures.appwrite.network |
malicious | Sinkholed |
| Hagezi Threat Feed | documentsignatures.appwrite.network |
malicious | Sinkholed |
| Quad9 DNS | documentsignatures.appwrite.network |
malicious | Sinkholed |
Forensic History & Detection Timeline
This timeline displays historical security and status checkpoints observed by the PhishDestroy automated monitoring network. It records domain lifecycle updates, scanner changes, and threat telemetry over time.
-
Cloudflare Radar Scan Mar 7, 2026 · 07:03 UTCCloudflare Radar scan registered: View Radar report.
-
Cloudflare Radar Scan Mar 7, 2026 · 07:00 UTCCloudflare Radar scan registered: View Radar report.
-
Domain Status Transition Mar 6, 2026 · 05:04 UTCDomain state transitioned from alive to dead.
-
VirusTotal Detections Update Mar 1, 2026 · 05:28 UTCVirusTotal scanner detections updated from 18 to 19. Added scanner alerts: ESET, Ermes, VIPRE. Resolved alerts: G-Data, OpenPhish.
Threat Response Pipeline
Discovery
Checks
Reports
Availability
16/17
Sent Report Recorded
Stored sent-report record for registrar GoDaddy.com, LLC, hosting provider, 1 abuse contact
abuse@fastly.com
Public Blocklist Status
Evasion analysis
Cloaking & traffic-distribution check
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
- Stored cloaking flag
- Not observed
- Cloaking score
- 0/6
- Last cloaking scan
- Server header seen by scanner
swoole-http-server
Scanner note: alive_content: raw=short_403; http=403; via=https_proxy; server=swoole-http-server
Live TDS fingerprint check
Seven Keitaro fingerprints plus a crawler-versus-browser comparison, run from the PhishDestroy scanner when this section scrolls into view.
Waiting
Stored Capture · 3 sources
Domain Intelligence
Domain
Server / ASN
Edge · AS54113 Fastly, Inc.
IP Context
Fastly shared edge
origin IP hidden
Edge-IP reputation is not attributed to this domain.
Registrar (base domain)
GoDaddy
(US)
(US)
IP Address
151.101.67.52
CDN
Geo San Francisco, US
San Francisco, USNetworkAS54113 · Fastly, Inc.
The origin IP is hidden behind a CDN proxy. Reverse-IP results for the edge address contain unrelated tenants; finding the origin requires passive DNS or certificate-transparency data.
Registration (base domain)appwrite.network · Created Feb 21, 2026 (211d)
HTTP Status403 Forbidden
Technical detailsDNS, SSL SANs, timestamps
First DetectedFeb 21, 2026
DOM Analysis
IoC Extraction
Submitted URLhttp://documentsignatures.appwrite.network/
TLS Fingerprint
TLS Observation
TLS SAN Domainsappwrite.networkimagine.diy
Case ID
ICANN OVERSIGHT
Registration: appwrite.network
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For the registrable domain appwrite.network behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accreditation is a contract, not a safety seal.
Verify ICANN fees
Read RAA §3.18
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Report This Domain
Submit evidence & help protect others
VirusTotal Analysis
10 / 91 security vendors flagged this domain
View on VT
Last analyzed Previous stored snapshot: 10 detections
alphaMountain.ai
Chong Lua Dao
CyRadar
ESET
Forcepoint ThreatSeeker
Fortinet
Gridinsoft
Lionic
SafeToOpen
Webroot
Archived Evidence
Wayback Machine Snapshot
A historical snapshot is available for evidence review
Site Performance Analysis
Google PageSpeed Insights — mobile performance audit of documentsignatures.appwrite.network · checked Mar 1, 2026
100
Good
Performance
FCP
0.92s
First Contentful Paint
LCP
0.92s
Largest Contentful Paint
CLS
0.012
Cumulative Layout Shift
TBT
0ms
Total Blocking Time
SI
0.92s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
Community reports
Reported by 1 community member, first seen Feb 21, 2026
- Stored reports
- 1
- Unique reported URLs
- 1
Accepted1
Evidence & External Reports
Security Analysis
Submitted Evidence Snapshot
Sent: Ledger records: 1
Case ID:
PD-20260221-DB6F63 Recipient: abuse@fastly.com
PDF notice generated Notice text archived (650 chars)
Abuse notice text as sent to the provider
Policy Violations: Illegal Activities: Active phishing operation targeting victims Fraud & Deception: Impersonation of legitimate services Identity Theft: Collection of credentials under false pretenses Applicable Laws (Unknown): International Anti-Cybercrime Regulations Budapest Convention on Cybercrime Universal Fraud Prevention Laws Phishing activities violate international cybercrime conventions and Unknown's domestic fraud laws. Action Required: This evidence-backed report demonstrates clear violations requiring suspension per your policies. Continued hosting exposes your organization to regulatory scrutiny and potential legal liability.
OSINT & Intelligence
DNS & Network
SEO & Domain
Were You Affected by This Site?
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Action Fraud
Report fraud and cybercrime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
97-country directory
Template-based draft • optional AI wording assistance requires separate consent
Review and submit it yourself
Related Infrastructure & Reports
Infrastructure map · documentsignatures.appwrite.network
Each spoke is one reason two domains are linked. Ring size marks VirusTotal detections; dashed nodes are already offline. Full lists below.
Content matches 3
Other reports on shared Fastly edge 6
Shared edge IP; unrelated tenants may be present.
au.answers.quantarchive.com Same registrar: GoDaddy 6
yeniyerler.com 
wyposazeniemieszkan.com DocuSign impersonation 8
These domains also target DocuSign users. View all DocuSign threats →
Recent threat reports 3
Recently added threat reports.
primarkpolska.pl 
ziajasklep.club 
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive