Phishing Reports

Phishing reports do not necessarily indicate a security issue. They can simply result from legitimate development or migration activities. Legitimate AEM URLs sometimes get reported by security researchers as potential phishing sites in a takedown request.

These reports typically concern publicly accessible aem.page or aem.live URLs that may appear like maliscious copies of existing websites. In most cases, these are legitimate versions of the same site, served through an AEM backend URL. This can happen when migrating an existing site, developing new features, or sharing preview links with others.

Why sites get reported

aem.page and aem.live URLs are publicly accessible by default, including feature branches. Sites looking identical or very similar to an existing website, but served from a different domain, may get flagged automated security scanners or researchers as a potential phishing attempt.

Both aem.page and aem.live URLs include noindex instructions for robots by default to prevent accidental indexing by search engines. But noindex does not restrict access: Anyone with the URL can still visit the site, and security scanners can still discover and inspect it.

Adobe's role

When Adobe receives a takedown request concerning an AEM site, Adobe may contact the site owner to make them aware of the report and share the reporter's contact details.

Adobe's role is to pass along the information so the site owner can review the report and determine the appropriate response. Adobe does not typically investigate or resolve reports concerning legitimate customer development or migration sites on the customer's behalf.

The site owner is responsible for deciding on next steps and communicating with the reporter.

If the site owner does not respond, Adobe reserves the right to enable authentication or disable the affected site to address the reported concern.

Next steps for site owners

If Adobe forwards a phishing report, the site owner should review the affected URL and confirm that it belongs to an authorized project.

If the site is legitimate, no technical changes are necessarily required. The site owner can contact the reporter directly to explain the purpose of the URL and clarify that it is part of an authorized project.

If the URL is no longer needed or should not be publicly accessible, available options include: