Skip to main content
Back to Security Snacks
Phishing

Phish Impersonating DocuSign

Published on: 
April 30, 2024

195 domains registered and used for credential phishing

We spotted 195 domains registered and used for credential phishing pulled from a phish impersonating DocuSign using a click thru URL obfuscator.

The initial domain was qi6kd[.]com which showed a google workspace login, off a DocuSign-impersonating email with a link to a malicious site.

‍

Related Content

SecuritySnacks
SecuritySnack - CloudFlare Anti-Security For Phishing
A Microsoft 365 credential harvesting campaign is exploiting CloudFlare's anti-bot and human verification features to evade detection. Learn how attackers use IP blocklists, user-agent filtering, and obfuscated scripts to bypass security scanners—and what it means for the industry.
Learn More
SecuritySnacks
Cybersecurity Reading List - Week of 2026-03-02
A broken snowblower belt taught me something cybersecurity professionals often forget — saying "I don't know" isn't failure. It's where the real work begins.
Learn More
SecuritySnacks
SecuritySnack - Idolized Crypto Scams
An analysis of an active cryptocurrency scam operation impersonating Trump, Musk, and Truth Social across 250+ domains — uncovering shared wallet infrastructure, on-chain laundering pipelines, and the tactics used to fake legitimacy.
Learn More

Heading

SecuritySnacks
Research
Newsletters
Podcast Episodes
About
No items found.