elaborate-products-order[.]netlify[.]app

This domain, elaborate-products-order.netlify.app, has been identified as an active brand impersonation threat targeting Adobe. The site presents a fraudulent interface mimicking Adobe’s document editing and signing platform, as evidenced by its page title, 'A.d.o.b.e | Edit - Sign - View.' The campaign is currently operational, posing a high risk to users who may unknowingly submit credentials or sensitive information to the malicious infrastructure. Analysis indicates the domain is hosted on Netlify and resolves to the IP address 35.157.26.135, located in AWS EC2’s eu-central-1 region (Germany). The domain was registered on May 9, 2026, though this date may reflect spoofed or manipulated registration metadata. Security vendors have flagged the domain in 15 of 95 VirusTotal scans, and it appears on at least one security blocklist. The SSL certificate is issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' intermediate, which, while legitimate in origin, is frequently leveraged by threat actors to lend a false sense of authenticity to malicious sites. The infrastructure and behavioral indicators suggest this campaign is designed for credential theft, specifically targeting users of Adobe’s cloud services. Organizations and individuals are advised to block the domain and IP at the network level, implement web filtering rules to prevent access, and conduct user awareness training to recognize brand impersonation tactics. Endpoint protection solutions should be updated to include detection for this domain, and any credentials potentially exposed to this site should be reset immediately. Monitoring for secondary payload delivery or follow-on attacks is recommended, as this infrastructure may be repurposed for additional malicious activity.