docusign[.]fotocloud[.]net

This domain is flagged for credential harvesting phishing, a threat type designed to deceive users into submitting authentication credentials through fraudulent document signing interfaces. The risk level is classified as elevated due to its targeted nature and the potential for significant data compromise, including corporate or personal sensitive information. Analysis indicates the domain docusign.fotocloud.net was registered on April 24, 2026, through Tucows Domains Inc. It resolves to the IP address 34.241.226.35, hosted on infrastructure located in Ireland (AWS EC2 eu-west-1 region). The domain appears on one security blocklist and is currently offline. VirusTotal reports 12 out of 95 security vendors flagging this domain as malicious. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 intermediate, a common certificate authority used in both legitimate and malicious domains. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP address (34.241.226.35) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) to endpoint detection and response (EDR) systems and email security gateways to prevent delivery of phishing attempts. User awareness training should emphasize verification of document signing requests, particularly those originating from unexpected or slightly altered domains. Additionally, organizations should monitor for unauthorized access attempts or anomalous authentication patterns following exposure to this domain.