Docusign Phishing Attempt via workers.dev Domain

Steven Lim@KQLWizard

•updated Mar 8, 2026•51•2•298

This rule detects potential phishing attempts targeting Docusign users. It identifies emails containing URLs or network connections to specific domains (page-docusign-[a-z0-9]+\.workers\.dev) which are commonly used in phishing campaigns to mimic legitimate Docusign login pages or related services. The use of 'workers.dev' subdomains often indicates malicious infrastructure.