docusign-ghj[.]christina-parsons-charter-comm-com-s-account[.]workers[.]dev

This domain represents a high-risk credential phishing operation targeting users through a fraudulent DocuSign interface. Analysis indicates the infrastructure is designed to harvest login credentials by impersonating legitimate document signing services, specifically exploiting the trust associated with the DocuSign brand. The domain employs social engineering tactics to trick victims into entering sensitive authentication details, which are then captured by the attackers for unauthorized access to corporate or personal accounts. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was created on April 15, 2026, and is registered through Cloudflare Workers, a platform frequently abused for rapid deployment of phishing pages. It resolves to IP address 172.67.219.111, hosted by Cloudflare in California, and uses a Let's Encrypt SSL certificate identified as E7. Security vendors have flagged this domain, with VirusTotal reporting 16 out of 95 detections. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy, confirming its malicious status. Users who have visited this domain or interacted with its content should take immediate remediation steps. Any credentials entered on this site must be considered compromised and should be changed immediately across all platforms where the same login details were reused. Organizations should monitor for unauthorized access attempts and review authentication logs for suspicious activity originating from the affected accounts. If browser sessions were established, clearing all active sessions and enabling multi-factor authentication is strongly recommended to prevent further exploitation. Network administrators should block the domain and associated IP address 172.67.219.111 at the perimeter to prevent additional exposure.