doeusignsafe[.]vercel[.]app

This domain, doeusignsafe.vercel.app, is confirmed as an active credential phishing site specifically targeting users of the DocuSign electronic signature platform. Analysis indicates the site is designed to harvest login credentials by mimicking the official DocuSign sign-in interface, as evidenced by the page title 'Sign In - DocuSign.' The domain remains operational and poses a high risk to individuals and organizations relying on DocuSign for document authentication. Infrastructure analysis reveals the domain is hosted on Vercel Inc.'s platform and resolves to the IP address 216.198.79.131. The SSL certificate is issued by Google Trust Services under the WR1 intermediate, a common certificate authority that does not inherently indicate malicious activity but is frequently exploited by phishing sites. Detection metrics show the domain is flagged by 19 of 95 security vendors on VirusTotal, with one entry on a public security blocklist. The domain's registration through Vercel Inc. aligns with patterns observed in phishing campaigns leveraging legitimate hosting services to evade initial detection. Current status confirms the domain remains active, with no evidence of takedown or mitigation. Organizations and end-users are advised to block access to this domain at the network perimeter and update endpoint protection rules to include the domain and associated IP address. Security teams should monitor for credential reuse attempts, particularly for accounts tied to DocuSign or other enterprise services. Users who may have interacted with this domain should immediately reset their credentials and enable multi-factor authentication where available. Proactive threat hunting for related indicators of compromise is recommended to identify potential breaches stemming from this phishing campaign.