docreviewcheckshpointeonline[.]com

PhishDestroy identifies docreviewcheckshpointeonline.com as a live credential-draining domain mimicking DocuSign’s document review interface. The site is engineered as a generic_phishing endpoint targeting users with the promise of secure document access, leveraging social-engineering tactics to trick victims into surrendering Microsoft 365 or corporate credentials. No branded drainer kit artifacts are visible in current sandbox runs, suggesting either a newly deployed or lightweight PHP-based exfiltration script typical of entry-level phishing operations.

Technical indicators confirm a newly spun domain: VirusTotal currently returns 1 out of 95 antivirus engines detecting maliciousness, registrar NAMECHEAP INC, creation date November 07, 2025, and resolution to IP 188.114.97.3. The certificate authority is Let’s Encrypt, and Google Safe Browsing has not yet blacklisted the domain. At the time of analysis, this domain remains absent from public threat intelligence feeds, highlighting its novelty and unflagged status.

This domain remains active and poses a documented risk to recipients of the associated lure emails. Immediate defensive actions include blacklisting the domain and IP at the network perimeter, blocking inbound TLS sessions to 188.114.97.3, and updating email gateways with a YARA rule targeting the unique seed 7d1458. While the current risk is elevated due to active availability and low detection coverage, the absence of prior sightings suggests opportunistic targeting rather than a large-scale campaign. Continued monitoring is required to assess expansion or escalation of tactics.