ai-image-generator-starter-ul8p6nh0ul[.]edgeone[.]dev

This domain, ai-image-generator-starter-ul8p6nh0ul.edgeone.dev, is actively serving a fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate AI-based image generation services, presenting a seemingly authentic interface to deceive visitors into entering sensitive account information. The threat specifically targets users seeking quick access to AI tools, exploiting their trust in cloud-based platforms to capture login details for subsequent unauthorized access or identity theft. Infrastructure analysis reveals the domain is registered through MarkMonitor Inc., a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 43.174.247.29 and is secured with an SSL certificate issued by DigiCert, Inc. (DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1). Detection metrics show 14 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while it appears on one security blocklist. The domain remains active as of the latest verification, indicating ongoing risk to unsuspecting users. Users who have visited ai-image-generator-starter-ul8p6nh0ul.edgeone.dev or entered credentials on the site should immediately revoke any submitted passwords and enable multi-factor authentication on associated accounts. Monitor linked accounts for unauthorized activity, particularly those tied to email, cloud storage, or financial services. If browser sessions were active during the visit, clear all cached data and cookies to eliminate residual tracking. Network administrators are advised to block the domain and its resolving IP at the perimeter to prevent further exposure.