n4zt-2ho6-4s85[.]adobe-signature-sharedoc-mail-com-s-account[.]workers[.]dev

This domain poses a high risk as a credential phishing threat, specifically designed to steal login credentials by impersonating Adobe Sign. The site mimics legitimate Adobe document-sharing workflows to trick users into entering their email and password. PhishDestroy assesses this threat as active and severe, given its sophisticated targeting and low detection rate among security vendors.

Technical indicators reveal that the domain was created on April 14, 2026, and is registered through Cloudflare Workers, a service often abused for phishing due to its ease of deployment. It resolves to IP 188.114.97.3 and uses a Let's Encrypt SSL certificate (E7), which provides a false sense of security. VirusTotal data shows that 12 out of 95 security vendors flag this domain, while it appears on one security blocklist. These factors collectively indicate a well-crafted phishing campaign with a moderate chance of evading traditional filters.

To mitigate this threat, users should never enter credentials on sites accessed via unsolicited links, especially those with long, convoluted subdomains. Always verify the URL by manually typing 'adobe.com' into the browser. Enable multi-factor authentication on all Adobe accounts to add an extra layer of protection. Report any suspicious emails or links to Adobe's security team and use PhishDestroy's domain checker to validate unknown URLs before interacting.