docusign-ekn[.]daniel-siragusa-hubintrenational-com-s-account[.]workers[.]dev

The domain docusign-ekn.daniel-siragusa-hubintrenational-com-s-account.workers.dev was registered on April 15, 2026 through Cloudflare Workers and resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. in Canada. The site presents a HTTP 500 response and the page title returned by the server is "Worker threw exception | docusign-ekn.daniel-siragusa-hubintrenational-com-s-account.workers.dev | Cloudflare," indicating that the underlying Cloudflare worker script failed to execute. The TLS certificate is issued by Let’s Encrypt (E8). VirusTotal scans show 12 of 94 security vendors flag the domain as malicious, and it appears on one external blocklist. PhishDestroy has already blocked the domain, yet it remains active as of the report date (July 12, 2026) and is classified as a high‑risk brand‑impersonation threat targeting the Cloudflare brand. Observed indicators suggest the domain is being used to masquerade as legitimate Cloudflare infrastructure, possibly to lure victims into interacting with the worker endpoint. Uncertainty remains around the specific payload or credential‑harvesting mechanisms, as no page content beyond the exception title has been captured. Defenders should block outbound connections to 188.114.96.3, add the full domain to DNS blocklists, monitor for any anomalous traffic to Cloudflare worker endpoints, and continue to reference threat‑intel feeds that list this indicator. Continuous re‑evaluation is advised since the domain is still active and may evolve its behavior.