adobepdf-crostata-material[.]netlify[.]app

This domain, adobepdf-crostata-material.netlify.app, poses a direct phishing threat by impersonating Adobe PDF authentication portals. The site mimics legitimate Adobe login interfaces, presenting a page titled 'A.d.o.b.e | Edit - Sign - View' to deceive users into entering credentials. Analysis indicates the domain is designed to harvest login details for subsequent unauthorized access to cloud storage, document management systems, or corporate networks where Adobe credentials may be reused. The phishing page employs visual spoofing techniques, including Adobe branding and UI elements, to increase credibility and lower user suspicion. Infrastructure analysis reveals the domain was hosted on Netlify infrastructure and resolved to the IPv6 address 2a05:d014:58f:6200::258 within the Amazon.com, Inc. AS16509 network, located in Germany. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides a false sense of security while facilitating encrypted credential transmission to attackers. The domain is flagged by 17 out of 95 security vendors on VirusTotal, and appears on two independent security blocklists, including PhishDestroy and PhishingDB. No legitimate creation date is available, but the domain was operational long enough to be detected and taken offline. Users who visited adobepdf-crostata-material.netlify.app should assume credential compromise. Immediate actions include resetting passwords for Adobe accounts and any other services where the same credentials were reused. Enable multi-factor authentication on all critical accounts to mitigate further risk. Monitor account activity for unauthorized access attempts or data exfiltration. Organizations should review logs for connections to the domain or its associated IP address (2a05:d014:58f:6200::258) and investigate any correlated authentication events. If credentials were entered, consider initiating a password reset across all linked services and notifying security teams for incident response.