energetic-indigo-dxeo7k8pg2[.]edgeone[.]app

This domain, energetic-indigo-dxeo7k8pg2.edgeone.app, is identified as a credential phishing endpoint targeting email account credentials. The page title 'Email Update' suggests an attempt to impersonate a generic email service provider or corporate login portal, though no specific brand was confirmed in the captured artifacts. The domain is currently offline, having been taken down following detection and blocking by security systems. Analysis indicates the domain was created on May 25, 2026, and registered through Tencent EdgeOne content delivery infrastructure. It resolved to the IP address 43.152.26.58 at the time of assessment. The domain was flagged by 21 of 95 security vendors on VirusTotal, indicating moderate consensus regarding its malicious nature. It appears on one security blocklist, and the SSL certificate is issued by DigiCert, Inc. under the 'DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1' intermediate, which does not inherently indicate compromise but is frequently leveraged in phishing campaigns to lend false legitimacy. Infrastructure analysis reveals the domain was hosted on a content delivery network, a common tactic to evade IP-based blocking and distribute malicious content across geographically dispersed nodes. Given the domain's current offline status, no active threat is present; however, similar domains may emerge using comparable naming conventions or infrastructure. Organizations are advised to monitor for domains with randomized subdomains under edgeone.app, particularly those referencing email updates or account verification. Network-level blocking of the resolved IP 43.152.26.58 is recommended as a precautionary measure. Security teams should also review logs for connections to this domain or IP within the past 30 days to identify potential credential exposure or lateral movement.