docu-sign-firmar[.]vercel[.]app

This domain, docu-sign-firmar.vercel.app, poses a high-risk phishing threat designed to mimic the legitimate Docusign electronic signature service. The site displays a fraudulent login interface under the page title 'Free Docusign Account: Sign Documents for Free | Docusign,' attempting to deceive users into entering sensitive credentials such as usernames, passwords, or financial information. Analysis indicates the site is actively harvesting data, which may be used for unauthorized account access, identity theft, or subsequent fraudulent transactions. The threat is particularly dangerous due to its professional appearance and exploitation of a trusted brand name to lower user vigilance. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.195, located in the United States. According to VirusTotal, 18 out of 95 security vendors have flagged this domain as malicious, and it appears on at least one security blocklist. The domain was created on April 16, 2024—an unusually recent date for a site claiming to offer a legitimate service—and uses an SSL certificate issued by Google Trust Services (WR1), which, while providing encryption, does not validate the site’s authenticity. The registrar and hosting provider, Vercel, are commonly abused by threat actors due to their free, easily deployable hosting services. Users who have visited docu-sign-firmar.vercel.app or entered credentials on the site should take immediate action to mitigate risk. First, cease all interaction with the domain and do not download any files or follow prompts. Change passwords for any accounts accessed after visiting the site, especially those associated with Docusign or email services. Enable multi-factor authentication where available to add an additional security layer. Monitor financial and digital accounts for unauthorized activity, including logins, transactions, or password reset attempts. If sensitive data was submitted, consider reporting the incident to relevant authorities and credit monitoring agencies. Organizations should also update internal blocklists to include this domain and its associated IP address to prevent further access.