sheer-red-lwi8kl5b[.]edgeone[.]dev

Analysis dated July 21, 2026 confirms that the domain sheer-red-lwi8kl5b.edgeone.dev is being used for a phishing operation. The domain was registered through Tencent Cloud, a cloud provider frequently leveraged by threat actors to host malicious infrastructure. DNS resolution resolves the domain to the IPv4 address 43.174.247.29, which remains reachable and continues to serve the malicious content. VirusTotal scans have flagged the domain in 14 of 95 security engines, indicating that a notable subset of commercial and open‑source detectors have identified it as malicious. The authoritative name‑server query returned NS_NOT_FOUND, suggesting that the nameserver information is either obscured or not publicly disclosed, a tactic often employed to hinder attribution. The domain is listed by PhishDestroy and appears on an additional security blocklist, bringing the total blocklist count to one. Current intelligence does not include SSL certificate details, HTTP response codes, or page‑title metadata, so content‑based signatures cannot be derived at this time. The threat profile is classified as high risk, and the operational status is active, as reflected in ongoing DNS resolution and blocklist presence. Unique seed 4c201c has been assigned for internal tracking of this indicator. Defensive recommendations are to add sheer-red-lwi8kl5b.edgeone.dev to proxy, firewall, and DNS sinkhole deny lists, monitor traffic to the associated IP address 43.174.247.29, and continue to ingest updates from threat‑intel feeds that reference this domain. Given the confirmed registration, active resolution, multiple vendor detections, and blocklist listings, the infrastructure should be treated as a high‑severity phishing vector and mitigated accordingly.