docu-sign[.]app

The domain docu-sign.app was registered on March 06 2026 through NiceNIC International Group Co., Limited. It is served from the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The DNS zone uses Cloudflare’s authoritative nameservers naya.ns.cloudflare.com and vasilii.ns.cloudflare.com, indicating the operator is leveraging Cloudflare’s CDN and DDoS‑mitigation services. An HTTPS endpoint is present, secured by a Let’s Encrypt certificate (issuer: Let’s Encrypt / E8). When accessed, the web server returns HTTP 403, and the page title displayed is “Nur einen Moment…”. The domain appears on a single public security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans have flagged the domain by one of ninety‑five security vendors, reinforcing a low‑level but non‑zero detection confidence. The limited response (403) prevents direct observation of the payload, leaving the exact phishing content ambiguous. However, the domain name closely mimics the legitimate DocuSign brand, a pattern commonly used in generic phishing campaigns to harvest credentials or distribute malicious documents. The presence of a valid TLS certificate and Cloudflare front‑end suggests the operator is attempting to evade simple network‑level blocks and to increase perceived legitimacy. Defenders should add docu-sign.app to web‑filter deny lists and configure proxy or firewall rules to block both HTTP and HTTPS traffic to the domain and its underlying IP address 188.114.96.3. Monitoring of DNS queries for the domain and its associated Cloudflare nameservers is recommended to detect any future re‑use. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset passwords and review account activity.