theforgecalculator[.]info

This domain, theforgecalculator.info, is identified as a brand impersonation threat targeting Adobe users. Analysis confirms the domain was actively used for credential harvesting, presenting itself as a legitimate Adobe service to deceive victims into submitting sensitive login information. The infrastructure is currently offline, but prior activity warrants continued monitoring due to its elevated risk classification. Infrastructure analysis reveals the domain was registered on December 12, 2025, through Spaceship, Inc., and resolved to the IP address 216.198.79.1, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate was issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. At the time of detection, the domain was flagged by 18 of 95 security vendors on VirusTotal and appeared on one security blocklist. The page title, 'The Forge Calculator Roblox,' suggests an attempt to masquerade as a gaming-related tool, likely to lower user suspicion while targeting Adobe’s user base. The domain has since been taken offline, reducing immediate risk to end users. However, historical activity and technical indicators confirm its malicious intent. Organizations are advised to block the domain and its associated IP (216.198.79.1) at the network level. Users who may have interacted with the domain should reset Adobe account credentials immediately and enable multi-factor authentication. Security teams should monitor for similar domains registered via Spaceship, Inc., particularly those impersonating Adobe or leveraging gaming-related themes to evade detection.