secure[.]sign-doc[.]com

The domain secure.sign-doc.com was registered on March 27, 2026 through Amazon Registrar, Inc. and remains active as of the report date, July 12, 2026. It is classified as a high‑risk credential‑phishing site and is currently listed on at least one public security blocklist. The unique seed 07ab09 has been associated with this observation.

Accessing the site returns an HTTP 302 response, redirecting visitors to a page whose title reads “You clicked on a QR code phishing test!”. The page is built with Unpkg, Modernizr, petite‑vue, and enforces HTTP Strict Transport Security (HSTS). DNS resolution is handled by four Amazon Route 53 nameservers: ns-1263.awsdns-29.org, ns-1960.awsdns-53.co.uk, ns-373.awsdns-46.com, and a fourth entry truncated in the source data. The domain is flagged by PhishDestroy and has been marked by three of ninety‑five VirusTotal security vendors.

The observed content suggests a QR‑code lure designed to harvest credentials, a pattern commonly employed in credential‑phishing campaigns. The use of a 302 redirect and HSTS indicates an attempt to preserve a secure transport layer while guiding victims through a controlled landing page. No explicit branding or victim‑specific targeting is visible, leaving the intended victim profile ambiguous. The presence of modern JavaScript frameworks such as petite‑vue points to a lightweight front‑end likely used to capture input fields without raising suspicion.

Defenders should add secure.sign-doc.com to DNS and URL filtering policies, monitor for outbound connections to the listed Amazon nameservers, and educate users about unsolicited QR codes that claim to verify documents or services. Continuous re‑evaluation of VirusTotal and blocklist statuses is advised, as additional detections may emerge. Incident response teams should be prepared to investigate any credential submissions that route through this domain.