DocuSign phishing & impersonation
Tech & Clouddocusign.com
230
Sites impersonating it
116
New in the last 30 days
0
Campaigns
2026-11-14
Last detected
Official domains
docusign.comdocusign.net
A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.
Also known as
d0cusign
Sites impersonating DocuSign
30 of 230 sites · newest first · repeat scans of a site are grouped
21 lower-risk copies are not shown: sites that use the DocuSign name or design, but that neither our rule engine nor our AI analysis rates high risk (for example harmless copies of the brand's own pages). Show them
RulesMaliciousAIHigh Risk“DocuSign” in page or screenshot textAI analysisScreenshot text
3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account. workers. dev DocuSign - Review Document2026-09-06 · seen 4×RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: Cloudflare Workers Phishing Kits (device-code / EvilToken & brand lures) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
c60u-ufhn-0uxb.office-sanisolutions123-onmicrosoft-com-s-account. workers. dev DocuSign - Review Document2026-09-05RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
fy5w-nxh6-g2ho.joliver-powershopscentralia-com-s-account. workers. dev DocuSign - Review Document2026-09-05 · seen 2×RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
gvhh-nc8x-hlli.kevartsbouvier-addisoncountypcc-org-s-account. workers. dev DocuSign - Review Document2026-08-29RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
pub-4e9d559e11c54314b7639d20c3d13682.r2. dev DocuSign Login - Enter your password to sign in2026-08-29 · seen 11×RulesHigh RiskAIHigh RiskCredential Phishing on object storage“DocuSign” in the page titlePage text
RulesHigh RiskAIHigh RiskDevice-code phishing“DocuSign” in the page titlePage text
njj.standard. us-east-1. oortstorages. com Docusign | #1 in Electronic Signature and Intelligent Agreement Managemen2026-08-26 · seen 3×RulesHigh RiskAIHigh Risk“DocuSign” in the page titlePage text
RulesLow RiskAIHigh Risk“DocuSign” in the page titleIdentical pagePage text
RulesLow RiskAIHigh Risk“DocuSign” in page or screenshot textPage text
wjdo-u2dx-kfh0.workspace-trello-document-proton-me-s-account. workers. dev DocuSign - Review Document2026-08-19RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMedium RiskAIHigh Risk“DocuSign” in the hostnamePage text
RulesLow RiskAIHigh Risk“DocuSign” in page or screenshot textPage text
RulesHigh RiskAIHigh RiskDevice-code phishing“DocuSign” in the page titlePage text
RulesLow RiskAIHigh Risk“DocuSign” in the page titlePage text
RulesHigh RiskAIHigh RiskPossible Docusign Phishing on cloud hosting“DocuSign” in page or screenshot textPage text
RulesHigh RiskAIHigh RiskPossible Docusign Phishing on cloud hosting“DocuSign” in page or screenshot textPage text
RulesMaliciousAIConfirmed Scam“DocuSign” in page or screenshot textPage text
us1-files-document-storage-files-s9046-k590577.storage-id-406936. workers. dev DocuSign - Review Document2026-07-22RulesHigh RiskAIHigh RiskDevice-code phishing“DocuSign” in the page titlePage text
9cmw-idx4-47fs.george-vandevorde-smithinsurancellc-com-s-account. workers. dev DocuSign - Review Document2026-07-13RulesHigh RiskAIHigh RiskIDS: ET PHISHING Generic Device Code Landing Page 2026-04-07 +1 more“DocuSign” in the page titlePage text
RulesMaliciousAIHigh RiskKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesHigh RiskAIHigh RiskPossible Microsoft 365 PhishingDocuSign logo on a non-official hostLogo / faviconPage text
RulesLow RiskAIConfirmed Scam“DocuSign” in the page titleLogo / favicon
12 further sites are not listed at all: the DocuSign name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).