suryaprasanthfx-ctxr7fqp4s[.]edgeone[.]dev

This domain, suryaprasanthfx-ctxr7fqp4s.edgeone.dev, is actively serving a high-risk phishing page impersonating Garena Free Fire, a popular mobile battle royale game. Analysis indicates the site uses the exact page title 'Garena Free Fire. Best survival Battle Royale on mobile!' to deceive users into believing they are accessing legitimate game content. The domain resolves to IP address 43.174.246.29 and is hosted on infrastructure managed by Aceville, with detected technologies including Node.js, Vue.js, and Nuxt.js, suggesting a modern web application designed to mimic official gaming portals. Infrastructure analysis reveals the domain is flagged by 16 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by DigiCert, Inc., which does not inherently validate the legitimacy of the site but ensures encrypted connections, a common tactic in phishing to appear trustworthy. The domain has extremely low trust scores, with Gridinsoft and Scamadviser both assigning scores of 1 or lower out of 100, reinforcing its classification as malicious. What remains uncertain is the exact payload or credentials being harvested, as well as the full extent of the campaign’s distribution. The use of edge computing infrastructure (indicated by the 'edgeone.dev' subdomain) may allow the threat actor to rapidly deploy and rotate phishing pages, complicating takedown efforts. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the network level. Security teams are advised to inspect logs for connections to 43.174.246.29 and monitor for any internal systems that may have interacted with the domain. User education should emphasize verifying URLs before entering credentials, particularly for gaming-related promotions or rewards.