public company · US
DocuSign
DOCUSIGN, INC.
E-signature; document-review lures.
- Primary official domain
- docusign.com
- Reviewed official domains
- 2 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
13
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
19
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF Could not fully evaluate (sender-specific macros) · Mail: Receives mail (2 MX hosts) · checked 2026-10-20 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- docusign
- Label aliases
- DocuSign
- Official domains
- docusign.com · docusign.net (all)
- Generated spellings
- 202 tracked · 81 observed somewhere · 121 not observed (all)
- Can receive mail
- 40 spellings and 5 reported domains publish MX records · mail at Above.com parking (parking placeholder) 22 · h-email.net (parking placeholder) 3 · IONOS 2 · 16 more (81 spellings and 13 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
| Common brand names | ||||||
docusignexpressfreightfinance[.]comMail: MXSPF · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive172.86.117.48 · Confirmed phishing host address (DomainSpoof, 48 hours)ROUTERHOSTING (AS14956) · US48.117.86.172.static.cloudzy.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
docusign[.]fotocloud[.]netMail: MXSPFDMARC · checked 2026-10-19mail at pmail.fotocloud.net · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive34.240.138.155Amazon Web ServicesAmazon Web Services (AS16509) · USec2-34-240-138-155.eu-west-1.compute.amazonaws.com52.48.92.206Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-48-92-206.eu-west-1.compute.amazonaws.com54.77.191.63Amazon Web ServicesAmazon Web Services (AS16509) · USec2-54-77-191-63.eu-west-1.compute.amazonaws.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
docusign-electronicsignature[.]remote-otp[.]comMail: MXSPFDMARC · checked 2026-10-19mail at pmail.remote-otp.com · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive34.240.138.155Amazon Web ServicesAmazon Web Services (AS16509) · USec2-34-240-138-155.eu-west-1.compute.amazonaws.com52.48.92.206Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-48-92-206.eu-west-1.compute.amazonaws.com54.77.191.63Amazon Web ServicesAmazon Web Services (AS16509) · USec2-54-77-191-63.eu-west-1.compute.amazonaws.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
docusign[.]riberaturisme[.]esMail: MXSPFDMARC · checked 2026-10-19mail at MailSpamProtection (mail security gateway) · DMARC policy none (monitor only) · sends via riberaturisme.es.spf.auto.dnssmarthost.net | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive103.153.182.197 · Confirmed phishing host address (DomainSpoof, 48 hours)SNTHOSTINGS-AS-AP SnTHostings (AS140947) · IN197.182.153.103.in-addr.arpa.snthostings.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
| Brand name inside a longer word | ||||||
login-verifydocusignauthentication[.]dannatel[.]com[.]brMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPFDMARC · checked 2026-10-19mail at mail.dannatel.com.br · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostnameBrand name inside a longer word | 2026-10-20Observed in feed | Alive50.116.86.19 · Confirmed phishing host address (DomainSpoof, 48 hours)Oracle CloudOracle Cloud (AS31898) · US50-116-86-19.unifiedlayer.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
5 registrable domains · 5 hostnames · page 1 of 1
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.