docusign-document-8cfe9c[.]netlify[.]app

This domain is flagged as a high-risk credential theft phishing operation targeting users through brand impersonation of DocuSign. Analysis indicates the infrastructure is designed to harvest login credentials, payment details, or other sensitive information by mimicking legitimate document-signing workflows. The domain presents an elevated risk due to its active status and targeted deception tactics. Infrastructure analysis reveals the domain docusign-document-8cfe9c.netlify.app was registered on April 08, 2026, through Netlify, a platform commonly exploited for rapid phishing deployment. It resolves to IP address 63.176.8.218, hosted on AWS EC2 in Frankfurt, Germany (eu-central-1). The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides a false sense of legitimacy. Detection metrics show 18 out of 95 security vendors on VirusTotal flag the domain as malicious, while PhishDestroy has already implemented blocking measures. The domain appears on at least one security blocklist, confirming its malicious classification. Mitigation requires immediate action to prevent credential compromise. Network administrators should block the domain and its resolving IP (63.176.8.218) at the firewall or DNS level. Endpoint protection systems should be updated to include this domain in denylists. Users should be educated to verify DocuSign email senders, check for legitimate domains (e.g., docusign.com or docusign.net), and avoid clicking links in unsolicited document notifications. Multi-factor authentication (MFA) should be enforced for all accounts to reduce the impact of potential credential theft. Security teams are advised to monitor for related indicators of compromise, including the SSL certificate thumbprint and any subdomains or redirect chains associated with this campaign.