Phishing - Fake Docusign

Looks like the site may already have been shutdown, but only got the email a half hour ago.

Email:

Please review and sign your document Docusign Logo

From: Ricardo Cordova ([email protected])

Comcast
Hello redacted,

I am sending you this request for your electronic signature, please review and electronically sign by following the link below.

View Documents

DocuSign. The fastest way to get a signature.®

This message was sent to you by Ricardo Cordova who is using the DocuSign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.


I wonder if it’s an attempt to get users to download a remote access server, since it goes to myvnc.com.

Site is down for URLScan and also from my VPN (St. Louis, MO exit gateway).

Looks like the base domain is handled by No-IP, and they hand out subdomains.