Today is very young. At 7:46 AM PST, we received an official looking document from a legitimate company called DocuSign. We have been signing documents lately using DocuSign so it was not unusual to receive a reminder from the company.
What was strange was the company said it was DocuSign, but the from address was not DocuSign. Instead, it was from dcameron at dorothyai.com. Doroathyai.com has been around for many years and is active in the Artificial Intelligence space. That was unusual, but the company seemed legitimate, so the temptation to move forward was there.
In the email, there is a button that supposedly is the link to a secure site. Still a bit cautious because of the unusual nature of the email, I peeked at the domain linked to the activate button in the email. Not to my surprise, the email link is to an entirely different domain. Check this out: https://uytrttr656678908ghvbcbvbbvnbmnbvcbvhjgfgkhjgfj.top/**/**/*****/=*******@aimfair.com. The actual address has been changed to prevent anyone from trying it out.
Clearly this link is up to no good. It actually wants me to enter my username to Aimfair. Wow! No thank you!
I checked out the domain called uytrttr656678908ghvbcbvbbvnbmnbvcbvhjgfgkhjgfj.top. Here are the formation statistics from whois.domaintool.com:
Formation Dates 3 days old
Created on 2025-02-18
Expires on 2026-02-18
Updated on 2025-02-19
The domain is 3 days old. We are among the first to be contacted by this phisher, and it clearly has unscrupulous ideas in mind. This is the first time a phisher has actually tried to gain access to our Aimfair account.
We all need to be diligent. Unfortunately, the world has become untrustworthy in many ways, and we all must be very careful with our communications over the Internet.
What was strange was the company said it was DocuSign, but the from address was not DocuSign. Instead, it was from dcameron at dorothyai.com. Doroathyai.com has been around for many years and is active in the Artificial Intelligence space. That was unusual, but the company seemed legitimate, so the temptation to move forward was there.
In the email, there is a button that supposedly is the link to a secure site. Still a bit cautious because of the unusual nature of the email, I peeked at the domain linked to the activate button in the email. Not to my surprise, the email link is to an entirely different domain. Check this out: https://uytrttr656678908ghvbcbvbbvnbmnbvcbvhjgfgkhjgfj.top/**/**/*****/=*******@aimfair.com. The actual address has been changed to prevent anyone from trying it out.
Clearly this link is up to no good. It actually wants me to enter my username to Aimfair. Wow! No thank you!
I checked out the domain called uytrttr656678908ghvbcbvbbvnbmnbvcbvhjgfgkhjgfj.top. Here are the formation statistics from whois.domaintool.com:
Formation Dates 3 days old
Created on 2025-02-18
Expires on 2026-02-18
Updated on 2025-02-19
The domain is 3 days old. We are among the first to be contacted by this phisher, and it clearly has unscrupulous ideas in mind. This is the first time a phisher has actually tried to gain access to our Aimfair account.
We all need to be diligent. Unfortunately, the world has become untrustworthy in many ways, and we all must be very careful with our communications over the Internet.