mytax-organizercb2fb515-ed38-4e88-b5db-e6b8c94dbf9f[.]ccc-food[.]com

This domain is flagged as an elevated-risk generic phishing threat designed to impersonate an Adobe Acrobat secure access portal. Analysis indicates the infrastructure was specifically crafted to harvest user credentials under the guise of legitimate document authentication services, as evidenced by the page title 'Adobe Acrobat - Secure Access' and the use of a Let's Encrypt SSL certificate to create a false sense of security. Infrastructure analysis reveals the domain was registered through Dynadot Inc on November 03, 2025, and resolves to the IP address 192.185.156.195, hosted by Oracle Corporation in the United States. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Detection metrics from VirusTotal show 21 out of 95 security vendors flagging the domain as malicious, with a Let's Encrypt R12 SSL certificate in use. The subdomain structure suggests an attempt to blend into legitimate traffic associated with the parent domain ccc-food.com. Mitigation against this type of credential phishing threat involves implementing multi-factor authentication for all document access portals, particularly those handling sensitive information. Network administrators should update perimeter security rules to block connections to 192.185.156.195 and domains registered through Dynadot Inc with similar naming patterns. End users should be trained to verify domain legitimacy before entering credentials, especially when prompted by unexpected document access requests. Monitoring for Let's Encrypt certificates issued to newly created domains with document-related keywords may help identify similar phishing infrastructure.