amyvanderoef[.]com

Analysis of amyvanderoef.com confirms active phishing infrastructure targeting Adobe Acrobat Sign users. The domain, registered on May 3, 2015, through GoDaddy.com, LLC, currently resolves to IP address 173.212.218.59 and uses nameservers ns1.pmlwebsites.com and ns2.pmlwebsites.com. The page title, 'Adobe Acrobat Sign - Secure Document Access,' directly aligns with credential harvesting tactics aimed at users expecting legitimate document signing workflows. As of July 24, 2026, the domain remains operational and is flagged on two security blocklists: PhishDestroy and OpenPhish.

VirusTotal reports five detections from security vendors, though the specific detection logic or signatures are not disclosed in available data. No Safe Browsing or OTX records are referenced in current intelligence, and SSL certificate details are not provided. The domain's age exceeds typical phishing campaign lifespans, suggesting either prolonged abuse or dormant periods followed by reactivation.

Defenders should treat this domain as high-risk and prioritize blocking at DNS, proxy, and endpoint levels. Network monitoring should include the IP 173.212.218.59 and associated hosting provider for lateral threat correlation. No evidence confirms the use of a phishing kit or specific payload delivery, so further forensic analysis of captured traffic or page artifacts is recommended to determine exact attack vectors.