er.wpprja.com was a credential phishing page posing as Docusign. It targeted people who expect contracts, invoices and HR forms to arrive for e-signature. PhishDestroy first flagged it on 2026-10-13. The site has been offline since 2026-10-16 and was still dead when last checked on 2026-10-19.
How the scam works
The page carried the title "D0CUSIGN", with a zero in place of the letter O, imitating the brand without spelling its name exactly. Schemes like this usually start with an email saying a document is waiting for signature. The link leads to a page styled like Docusign that asks the visitor to sign in with their email or Microsoft 365 credentials before viewing the file. No document exists. Whatever is typed into the form goes to the operators, who can then take over the mailbox, search it for invoices and payment threads, and use it to phish the victim's contacts.
Evidence
On 2026-10-13, VirusTotal showed 11 of 92 engines flagging the domain. Those engines were alphaMountain.ai, BitDefender, CRDF, DNS8, ESET, Forcepoint ThreatSeeker, G-Data and Gridinsoft. That is a minority of engines, but it includes several major endpoint and web-filtering vendors, so users of those products would have been warned. urlscan.io independently rated the page malicious and recognised Docusign branding on it. Among the blocklists we track, it appears on PhishDestroy's.
Infrastructure
The domain was registered through IONOS SE on 2026-09-08, 35 days before we detected it. That short gap is typical of throwaway domains set up for a single campaign. The odd subdomain points to infrastructure built for disposable use rather than any real business. It resolved to an IP address on the Contabo GmbH network, which geolocates to the United Kingdom. A Let's Encrypt certificate gave the page a browser padlock, which proves nothing about whether a site is legitimate.
What to do
If you entered a password on this page, change it right away, along with any other account that uses the same password. Then sign out all active sessions. Turn on app-based or hardware-key two-factor authentication, and check your mailbox for forwarding rules or filters you did not create. Warn colleagues and contacts, because a stolen mailbox is often used to send the next wave of fake signing requests. Security teams should block the domain, search mail logs for messages linking to it, and reset credentials for any user who clicked through between 2026-10-13 and 2026-10-16. For any unexpected document, verify it by logging in to Docusign directly rather than following an email link.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(DE)
