office-docusign-net[.]tammy-e82[.]workers[.]dev

Analysis indicates that the domain office-docusign-net.tammy-e82.workers.dev is actively flagged as a phishing threat targeting DocuSign users. Registered through Cloudflare Workers on February 8, 2019, this domain resolves to the IP address 188.114.96.3, which is associated with Cloudflare's infrastructure. As of July 29, 2026, the domain appears on at least one security blocklist and is explicitly blocked by PhishDestroy. VirusTotal reports that 16 out of 91 security vendors have detected this domain as malicious, providing concrete evidence of its elevated risk status.

The use of Cloudflare Workers for registration is notable, as this platform is frequently leveraged by threat actors to rapidly deploy and rotate phishing domains while maintaining operational anonymity. The domain's structure, incorporating 'office-docusign-net', suggests an intent to deceive users into believing it is affiliated with DocuSign, a widely used electronic signature service. However, the exact content and mechanics of the phishing page remain unanalyzed, as no direct inspection of the site has been conducted. Defenders should treat this domain as an active threat and implement blocking measures at the DNS, proxy, or endpoint level.

Security teams are advised to monitor for connections to 188.114.96.3 and review logs for any interaction with this domain, particularly in environments where DocuSign is utilized. Given the domain's persistence since 2019, it may be part of a broader, long-running phishing campaign. No additional brand-specific indicators, such as page titles or phishing kit signatures, are currently available for further classification.