adobe-4s9[.]kpenza-htrenchless-com-s-account[.]workers[.]dev

The domain adobe-4s9.kpenza-htrenchless-com-s-account.workers.dev actively impersonates Adobe to conduct phishing attacks. It is hosted by Cloudflare and has been flagged as malicious by 17 out of 95 vendors on VirusTotal. This indicates a significant level of detection, suggesting the domain's phishing activities are recognized by many security solutions.

This domain is registered through Cloudflare Workers and utilizes Let's Encrypt for its SSL certificate. Such infrastructure choices are common among phishing operations due to their ease of setup and the credibility they lend to malicious sites. The domain's hosting IP, 104.21.96.51, is located in Canada and is part of Cloudflare's network, which provides robust performance and anonymity for the operators.

PhishDestroy has included this domain in its public blocklist, highlighting its threat level. The domain's creation date in 2026 raises questions about the accuracy of registration data, possibly indicating an attempt to obfuscate its true age and activity timeline. This tactic could be used to mislead security researchers and automated detection systems.

Overall, the domain's activity and detection by multiple security vendors underscore the importance of recognizing and mitigating phishing threats quickly. The use of Adobe's brand in this phishing scheme likely aims to exploit users' trust in the well-known software company, making it crucial for potential victims to verify the authenticity of any communication or site purporting to be from Adobe.