365hty1[.]vip

This domain, 365hty1.vip, is confirmed as a high-risk credential harvesting site targeting Adobe users. Analysis indicates the infrastructure was designed to impersonate Adobe login portals, tricking users into submitting account credentials, payment details, or other sensitive information under false pretenses. The page title 'bet365' suggests an attempt to mislead users or obfuscate the true intent of the domain, potentially leveraging brand confusion to increase the likelihood of successful compromise. Such tactics are commonly employed in targeted phishing campaigns aimed at corporate or individual users of Adobe’s cloud services, including Creative Cloud, Document Cloud, or Experience Cloud platforms. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on October 29, 2025, through Dynadot LLC, a registrar frequently used in malicious operations due to its accessibility and privacy features. It resolved to the IP address 34.92.22.66, hosted on Google LLC’s AS396982 in Hong Kong, a region often associated with transient or bulletproof hosting environments. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classified it as phishing. Additionally, the domain appeared on two independent security blocklists, further corroborating its malicious nature. Notably, the absence of an SSL certificate increases the risk of interception or tampering during credential transmission, though users may still perceive the site as legitimate due to browser-based security warnings being suppressed or ignored. Users who visited 365hty1.vip or entered credentials on any page hosted under this domain should assume their account details have been compromised. Immediate action is required: reset passwords for all Adobe-related accounts, including any linked services or single sign-on (SSO) integrations. Enable multi-factor authentication (MFA) where available, using app-based or hardware tokens rather than SMS or email-based methods. Monitor accounts for unauthorized activity, such as unexpected file modifications, shared documents, or unusual login attempts from unfamiliar locations or devices. If financial information was submitted, contact the relevant institution to report potential fraud and request account monitoring. Organizations should review logs for signs of lateral movement or unauthorized access originating from compromised credentials. Given the domain’s registration date and hosting characteristics, this infrastructure may have been part of a broader campaign; users should remain vigilant for similar phishing attempts using variations of the domain name or Adobe branding.