docsign[.]dn3[.]co

This domain, docsign.dn3.co, was registered through Porkbun on 12 September 2022 and is currently hosted on Cloudflare infrastructure, indicated by the authoritative nameservers jihoon.ns.cloudflare.com and mallory.ns.cloudflare.com. The domain resolves to the IP address 172.67.142.187, which belongs to a Cloudflare edge node. TLS termination is provided by Google Trust Services under the WE1 certificate, demonstrating a valid HTTPS configuration that may lend credibility to malicious pages. Google Safe Browsing has classified the domain under the SOCIAL_ENGINEERING category, and VirusTotal reports that 9 of 91 scanned security vendors flag it as malicious. The combination of a relatively recent creation date, use of reputable CDN services, and active detection by multiple security tools aligns with a high-risk generic phishing profile. The threat remains active as of the report date. Defenders should treat the domain as hostile: block outbound connections to the IP, add the fully qualified domain to URL filtering lists, and monitor DNS queries for the domain. Continuous re-evaluation is advised, as the underlying infrastructure can shift behind Cloudflare's dynamic edge network.