docusign[.]well-done[.]kz

On July 19, 2026 analysts recorded the domain docusign.well-done.kz as an active generic phishing infrastructure with a high risk rating. The site returns an HTTP 302 redirect and presents the page title "Account Suspended"; no further page content has been publicly disclosed. TLS is provided by a Google Trust Services certificate issued under the WE1 authority, indicating the use of a reputable certificate chain. DNS resolution points to IP address 172.67.216.2, which is hosted by Cloudflare, Inc. and geolocated to Canada. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans show that six of ninety‑one security vendors flag the domain, suggesting a modest but notable detection rate. While the infrastructure details confirm a Cloudflare‑based hosting model and a valid Google certificate, the specific payload, credential‑stealing mechanisms, or targeted brand impersonation remain unverified. Defenders should add docusign.well-done.kz to network and email filtering rules, monitor DNS queries for the associated IP, and consider sharing the indicator with additional threat‑sharing communities to improve detection coverage. Continuous re‑evaluation is advised as further intelligence becomes available.