DocuSign phishing & impersonation
Tech & Clouddocusign.com
230
Sites impersonating it
116
New in the last 30 days
0
Campaigns
2026-11-14
Last detected
Official domains
docusign.comdocusign.net
A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.
Also known as
d0cusign
Sites impersonating DocuSign
50 of 230 sites · newest first · repeat scans of a site are grouped
21 lower-risk copies are not shown: sites that use the DocuSign name or design, but that neither our rule engine nor our AI analysis rates high risk (for example harmless copies of the brand's own pages). Show them
RulesHigh RiskAIConfirmed Scam“DocuSign” in the page titlePage text
RulesMaliciousAIConfirmed ScamIDS: ET ATTACK_RESPONSE RMM Payload Delivery Page ObservedIdentified as DocuSign by our AI analysisAI analysis
RulesMedium RiskAIHigh Risk“DocuSign” in the hostnamePage text
RulesLow RiskAIConfirmed Scam“DocuSign” in the page titlePage text
RulesLow RiskAIConfirmed Scam“DocuSign” in the page titlePage text
RulesLow RiskAIHigh Risk“DocuSign” in the page titlePage text
RulesHigh RiskAIConfirmed ScamPossible DocuSign Phishing on cloud hosting“DocuSign” in the page titlePage text
RulesHigh RiskAIConfirmed Scam“DocuSign” in the page titlePage text
RulesHigh RiskAIConfirmed Scam“DocuSign” in the page titlePage text
RulesLow RiskAIHigh Risk“DocuSign” in the page titleAI analysis- RulesLow RiskAIHigh Risk“DocuSign” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“DocuSign” in the page titlePage text
RulesLow RiskAIHigh Risk“DocuSign” in the page titlePage text
RulesLow RiskAIHigh Risk“DocuSign” in the page titleAI analysis
RulesLow RiskAIHigh RiskIdentified as DocuSign by our AI analysisAI analysis
wahala-er-98gzp-0031f4.am2om247. workers. dev DocuSign | Action Required: Identity Verification2026-10-08 · seen 2×RulesHigh RiskAIHigh RiskDevice-code phishing“DocuSign” in the page titleAI analysisPage text
RulesMedium RiskAIHigh Risk“DocuSign” in the page titleIdentical page
RulesLow RiskAIHigh Risk“DocuSign” in the page titlePage text
RulesMedium RiskAIHigh Risk“DocuSign” in the page titleAI analysis
RulesLow RiskAIHigh Risk“DocuSign” in the page titleAI analysisPage text
RulesHigh RiskAIHigh RiskDevice-code phishing“DocuSign” in the page titleAI analysisPage text
RulesHigh RiskAIHigh Risk“DocuSign” in the page titleAI analysis
RulesHigh RiskAIConfirmed Scam“DocuSign” in the page titlePage text
RulesLow RiskAIHigh RiskIdentified as DocuSign by our AI analysisAI analysis
RulesHigh RiskAIHigh RiskIdentified as DocuSign by our AI analysisAI analysis
RulesMedium RiskAIHigh RiskIdentified as DocuSign by our AI analysisAI analysis
RulesLow RiskAIHigh Risk“DocuSign” in the page titleAI analysisPage text
RulesHigh RiskAIHigh Risk“DocuSign” in the page titleAI analysis
RulesMaliciousAIConfirmed ScamKnown Kit: Cloudflare Workers Phishing Kits (device-code / EvilToken & brand lures) (cloudflare_workers_phishing)“DocuSign” in the hostnamePage text
RulesMaliciousAIConfirmed ScamKnown Kit: Cloudflare Workers Phishing Kits (device-code / EvilToken & brand lures) (cloudflare_workers_phishing)“DocuSign” in the hostnamePage text
75t7-h6gu-8j8z.jessica-axismechanicalnc-com-s-account. workers. dev DocuSign - Review Document2026-10-01RulesMaliciousAIConfirmed ScamKnown Kit: Cloudflare Workers Phishing Kits (device-code / EvilToken & brand lures) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMedium RiskAIHigh Risk“DocuSign” in the page titleAI analysis
RulesLow RiskAIConfirmed Scam“DocuSign” in the page titlePage text
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“DocuSign” in the page titlePage text
RulesLow RiskAIHigh Risk“DocuSign” in the page titlePage text
RulesHigh RiskAIHigh RiskDevice-code phishing“DocuSign” in the page titlePage text
RulesHigh RiskAIModerate RiskIdentified as DocuSign by our AI analysisAI analysis
RulesMaliciousAIConfirmed ScamKnown Kit: EvilTokens 'ghost' AES-GCM cloaking loader (hunting rule) (cloudflare_workers_phishing)“DocuSign” in the page titlePage text
RulesMedium RiskAIHigh Risk“DocuSign” in the hostnameAI analysis
RulesHigh RiskAIHigh RiskCredential Phishing on disposable hosting“DocuSign” in page or screenshot textScreenshot text
RulesMaliciousAIHigh RiskKnown Kit: OPTA / Nova Panel: device-code phishing pages that hand a Microsoft sign-in code to an operator panel (opta-nova-device-code-2026-11)“DocuSign” in the page titlePage text
RulesLow RiskAIHigh RiskIdentified as DocuSign by our AI analysisAI analysis
RulesMaliciousAIConfirmed ScamIdentified as DocuSign by our AI analysisAI analysis
RulesMaliciousAIHigh RiskIDS: ET PHISHING Request for Possible Docusign Phishing Hosted on Github.io“DocuSign” in the hostnamePage text
RulesLow RiskAIConfirmed ScamIdentified as DocuSign by our AI analysisAI analysis
feminist-brown-plkm1dgi.edgeone. dev Docusign | #1 in Electronic Signature and Intelligent Agreement Managemen2026-09-18 · seen 2×RulesHigh RiskAIConfirmed Scam“DocuSign” in the page titleLogo / faviconPage text
RulesLow RiskAIConfirmed ScamIdentified as DocuSign by our AI analysisAI analysisIdentical page
RulesMedium RiskAIHigh Risk“DocuSign” in the hostnameAI analysis
RulesHigh RiskAIConfirmed ScamIdentified as DocuSign by our AI analysisAI analysis
RulesMedium RiskAIConfirmed Scam“DocuSign” in the hostnameAI analysis
12 further sites are not listed at all: the DocuSign name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).