docu[.]sign-platform[.]app

This domain, docu.sign-platform.app, is identified as a high-risk phishing site designed to impersonate the legitimate DocuSign electronic signature platform. Analysis indicates the threat falls under the category of credential harvesting, likely targeting corporate users or individuals expecting document signing requests. The domain mimics the official DocuSign branding through its subdomain structure, a common tactic to deceive victims into entering sensitive login credentials or personal information. No direct evidence of a cryptocurrency drainer kit was observed, though the infrastructure aligns with broader phishing campaigns exploiting trusted brand identities. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network often leveraged to obfuscate origins and evade takedowns. Detection engines report 22 out of 95 security vendors flagging the domain as malicious on VirusTotal, while Google Safe Browsing explicitly classifies it as phishing. Additionally, the domain appears on at least one security blocklist, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but is routinely exploited in phishing operations. As of the latest assessment, docu.sign-platform.app has been taken offline, reducing immediate exposure to potential victims. However, residual risk persists due to the domain's recent creation and the possibility of infrastructure reuse. Organizations and individuals are advised to monitor for similar impersonation attempts, particularly those leveraging subdomains of newly registered or typosquatted domains. Network-level blocking of the resolved IP (188.114.97.3) and registrar-based domains may mitigate future threats from this actor. Users who interacted with the domain should reset credentials and enable multi-factor authentication on associated accounts.