docusign-auth-docusign-com[.]dporozok[.]workers[.]dev

PhishDestroy identifies the domain docusign-auth-docusign-com.dporozok.workers.dev as a live credential theft site posing as DocuSign authentication. The page mimics legitimate DocuSign login flows to steal email/password combinations, which are then harvested for account takeover or sold on dark-web markets. Unlike generic phishing pages, this site uses workers.dev to bypass traditional hosting filters and relies on Cloudflare’s infrastructure to obscure its origin, making detection slower as shown by 0 detections out of 95 VirusTotal scans. The domain was registered through Cloudflare, Inc. and resolves to IP 188.114.96.3 with a Let's Encrypt SSL certificate, further enhancing its appearance of legitimacy. This domain was flagged on seed f210ca under active investigation for brand impersonation targeting DocuSign users. The use of workers.dev subdomains is a known tactic to host short-lived phishing pages that evade blacklists through rapid rotation. The combination of 11/95 VirusTotal detections and Cloudflare fronting suggests this campaign is still in early deployment, increasing the risk of successful credential harvesting before takedown. The SSL certificate issued by Let’s Encrypt adds a false sense of security, as users often trust HTTPS indicators without verifying the actual domain or hosting provider. If you visited this page or entered any information, immediately change your DocuSign password using a separate device or network. Enable multi-factor authentication (MFA) on your DocuSign account and scan your device for malware using reputable antivirus software. Report the domain to your IT security team or DocuSign’s fraud portal at trust@docusign.com. Avoid clicking links in unsolicited emails purporting to be from DocuSign—always navigate directly to docusign.com to access login pages.