docusignzweb[.]weebly[.]com

Analysis shows that docusignzweb.weebly.com resolves to the IPv4 address 74.115.51.8 and is delivered through Cloudflare front‑end services. The site is built on the Weebly platform and incorporates MySQL, PHP, Amazon Web Services back‑end components, reCAPTCHA, jQuery and Google Analytics for tracking. The domain appears on two public phishing blocklists and is specifically listed by PhishDestroy and OpenPhish as an active generic phishing infrastructure. VirusTotal records indicate that 13 of 91 scanned security engines have classified the host as malicious, reinforcing the blocklist observations.

Registration data reveals the domain was purchased through Square, Inc., but the authoritative name servers could not be resolved (NS_NOT_FOUND), suggesting a possible misconfiguration or deliberate attempt to hide resolver information. No SSL certificate details, HTTP status codes, or page‑title information are currently available, limiting visibility into the exact payload delivered to victims. Because the site’s page content has not been captured, the specific credential‑stealing technique cannot be confirmed, and the lack of visible name server records hampers attribution of the hosting environment.

Defenders should immediately block the domain and its resolving IP at perimeter and DNS filtering layers, add it to internal threat intelligence feeds, and monitor for any traffic to the associated Cloudflare edge nodes. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in the site’s content or hosting. The presence on multiple reputable blocklists and the multi‑engine detection rate justify a high‑risk posture for any user interaction with this domain.