docusign-electronicsignature[.]remote-otp[.]com

This domain, docusign-electronicsignature.remote-otp.com, is actively flagged as a high-risk phishing endpoint targeting DocuSign users. Analysis indicates the site is operational, returning an HTTP 200 status code and hosting content that mimics legitimate electronic signature workflows. The domain resolves to 52.209.163.93, an IP address hosted on AWS EC2 in the eu-west-1 region, a common infrastructure choice for phishing campaigns due to its scalability and low-cost provisioning. The SSL certificate, issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 hierarchy, provides basic encryption but does not validate the legitimacy of the site’s intent or ownership. Security vendors have detected malicious activity associated with this domain, with 10 out of 95 engines on VirusTotal flagging it as phishing-related. The domain is also present on at least one security blocklist and is actively blocked by enterprise phishing detection systems. The inclusion of HSTS headers suggests an attempt to appear legitimate, though this alone does not mitigate the underlying threat. The domain was registered through Tucows, a registrar frequently used for both legitimate and malicious domains, and no historical ties to DocuSign or its authorized partners have been established. Defenders should treat this domain as a confirmed phishing threat. Immediate action includes blocking the domain and its resolving IP at the network perimeter, as well as monitoring for internal traffic attempting to access it. Given the use of AWS infrastructure, additional scrutiny of cloud-based egress traffic is recommended. End-user education should emphasize verifying the authenticity of DocuSign-related communications, particularly those requesting sensitive actions such as OTP entry or document signing. If internal systems have interacted with this domain, incident response procedures should be initiated to assess potential credential exposure or malware delivery.