This phish typically originates from a non-Cornell account. The sender may appear as "DocuOnline® Via E-Signature <[user]@ipexxgroup.com>". The link within directs to a fake login page. Do not reply to the sender nor follow the link. If you entered your credentials into the form, change your NetID password at https://netid.cornell.edu.
At Cornell we value your privacy. To view our university's privacy practices, including information use and third parties, visit University Privacy.