oportoflowers[.]pt

This domain, oportoflowers.pt, is identified as a high-risk phishing site impersonating DocuSign, a widely used electronic signature service. The threat involves a fake login page titled 'DocuSign Login - Enter your password to sign in,' designed to harvest user credentials. Analysis indicates no direct evidence of a crypto drainer kit, but the infrastructure supports credential theft through brand impersonation. The domain leverages technologies including PrestaShop, MySQL, PHP, Apache HTTP Server, and jQuery, which may facilitate the deployment of phishing content. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.11.167.214 and was registered on July 25, 2016. It is flagged by 20 out of 95 security vendors on VirusTotal and appears on four security blocklists, including PhishDestroy, PhishingArmy, PhishingDB, and OISD. The domain utilizes a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. AlienVault OTX records the domain in 50 threat intelligence pulses, further confirming its malicious classification. Google Safe Browsing (GSB) status is not explicitly provided but is inferred as malicious due to widespread blocklisting. The domain has been marked as taken down, reducing immediate risk to end users. However, residual threats persist, including potential reuse of the infrastructure for future phishing campaigns. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window, particularly those associated with DocuSign or financial services. Organizations should monitor for unauthorized access attempts and update blocklists to include the domain and associated IP address. Continuous vigilance is recommended, as threat actors may re-establish operations under similar or newly registered domains.