docesign.live
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of docesign.live
The domain docesign.live appears to host a simple landing page themed around opening or downloading a shared document attachment. The visible page title, "Download Attachment," and the on-page text suggest a document-delivery or file-sharing workflow, presenting a button to view project details in PDF form. Based on the screenshot, the site does not appear to provide broader company information, navigation, or supporting content beyond this single-purpose prompt.
The domain name closely resembles the name of a well-known electronic signature and document platform, which may cause confusion for visitors expecting an established document service. No clear operator identity, business details, or organizational attribution are visible in the provided scan data or screenshot. Based on the available evidence, this appears to be a newly created, minimal document-themed web page rather than a fully developed business website.
Safety Assessment for docesign.live
At the time of this scan, no malware detections were reported by the security engines referenced in the scan data, and the checked blacklist and threat-database entries did not show active listings. The page also uses a valid HTTPS certificate, which helps encrypt traffic in transit. However, these positive signals are limited by the fact that the domain is only a few days old, has no established traffic ranking, and presents a very minimal attachment-download interface with little supporting context.
A notable concern is that the domain name closely resembles a well-known document-signing brand, while the page itself encourages the visitor to open an attachment-like file. That combination may indicate a look-alike setup intended to benefit from brand familiarity or user trust, even if automated scanners have not yet flagged it. Newly created domains used for document delivery, login prompts, or attachment lures can carry elevated risk because reputation systems may not have had enough time to classify them.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site presents a valid SSL/TLS certificate issued by a mainstream certificate authority, with expiry in January 2027. It appears to be served through Cloudflare infrastructure, with the web server identified as cloudflare and hosting geolocated to Warsaw, Poland in the scan data. The domain uses Name.com nameservers and its DNSSEC status is unsigned.
From a technical standpoint, the setup looks lightweight and recently deployed. The scan found no flagged files, no flagged external links, and no iframe usage at the time of inspection. Even so, the combination of a very new domain, sparse page content, and brand-resembling naming may warrant additional caution beyond the raw malware-scan results alone.
Share your experience with this website. Was it safe? Did you encounter any issues?