# PhishDestroy domain threat record: early-upright-mongrel.edgecompute.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/early-upright-mongrel.edgecompute.app/
Machine-readable companion: https://phishdestroy.io/domain/early-upright-mongrel.edgecompute.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 14:24:00 UTC
- Last availability or vendor check: 2026-10-27 23:04:58 UTC
- Stored record updated: 2026-10-27 23:22:18 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: PhishFeed
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 151.101.129.51
- Registrar in stored WHOIS data: MarkMonitor Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2019-09-26 15:20:49 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a15c03-6528-7649-8be2-ac81ac5f6e80/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/early-upright-mongrel.edgecompute.app
- Certificate Transparency search: https://crt.sh/?q=%25.early-upright-mongrel.edgecompute.app
- Web Archive lookup: https://web.archive.org/web/*/https://early-upright-mongrel.edgecompute.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI marked the URL as malicious based on fresh URLScan evidence and an AI‑generated phishing confidence of 90 %. The recorded page title “Auto Login” and the excerpt showing a sign‑in form with email and password prompts match the credential‑theft pattern described in the prior assessment. The domain was first seen by PhishDestroy on 2026-10-25.

How the scam works
Credential‑harvesting phishing typically presents a replica login interface that captures any entered usernames, passwords or recovery phrases and forwards them to the attacker. Victims are tricked into believing the page belongs to a legitimate service, enabling subsequent account takeover.

Evidence
VirusTotal reported 15 malicious detections out of 92 engines on 2026-10-01, with vendors such as ESET, Fortinet and ADMINUSLabs labeling the domain as phishing. URLScan captured the site on 2026-10-21 and returned a malicious verdict with a perfect phishing score of 100, identifying a generic email brand. Cloudflare Radar also marked the URL as malicious phishing on 2026-10-25. Google Safe Browsing did not flag the site on the same day. The domain appears on the external PhishFeed blocklist and is listed internally by PhishDestroy, while OTX showed zero pulses.

Infrastructure
The recorded domain age was 434 days and the TLS certificate for *.edgecompute.app was issued by GlobalSign Atlas on 2026-09-19, valid until 2027-04-06. The recorded IP address was 151.101.129.51, associated with Fastly, Inc., and the DNS record showed a CNAME to ecp.map.fastly.net. The observed network information listed ASNs 13335 and 54113, and the recorded country for the IP was DE.

What to do
Do not submit any credentials on this page; if credentials were entered, change the associated passwords immediately and review account activity. Organizations should block the domain at the network perimeter and monitor logs for connections to early-upright-mongrel.edgecompute.app. Security teams can add the domain to threat‑intel feeds and enforce email filtering to prevent similar phishing lures.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15c03-6528-7649-8be2-ac81ac5f6e80/
Cloudflare Radar report: https://radar.cloudflare.com/scan/3f708fcb-578e-4bde-ade8-7e059d3def89
Stored capture screenshot: https://urlscan.io/screenshots/01a15c03-6528-7649-8be2-ac81ac5f6e80.png
Cloudflare Radar screenshot (2026-10-25T14:26:16Z): https://screenshots.phishdestroy.io/cf/3f708fcb-578e-4bde-ade8-7e059d3def89.png
URLScan screenshot (2026-08-19T04:29:34Z): https://screenshots.phishdestroy.io/us/01a01848-0477-710a-a64d-b6b6619f379c.png
URLScan capture report: https://urlscan.io/result/01a01848-0477-710a-a64d-b6b6619f379c/
URLScan screenshot (2026-08-29T03:03:37Z): https://screenshots.phishdestroy.io/us/01a04b78-eadd-7722-8fc5-4cb7d8949704.png
URLScan capture report: https://urlscan.io/result/01a04b78-eadd-7722-8fc5-4cb7d8949704/
URLScan screenshot (2026-09-01T05:03:11Z): https://screenshots.phishdestroy.io/us/01a05b59-723e-751b-9e18-a207ce29ea01.png
URLScan capture report: https://urlscan.io/result/01a05b59-723e-751b-9e18-a207ce29ea01/
URLScan screenshot (2026-09-27T08:00:56Z): https://screenshots.phishdestroy.io/us/01a0e1e1-6710-753b-ab41-ca9c365edd24.png
URLScan capture report: https://urlscan.io/result/01a0e1e1-6710-753b-ab41-ca9c365edd24/
VirusTotal report: https://www.virustotal.com/gui/domain/early-upright-mongrel.edgecompute.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=early-upright-mongrel.edgecompute.app
Archived copy: https://web.archive.org/web/20261025142412/https://early-upright-mongrel.edgecompute.app/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 14:28:12 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a15c03-6528-7649-8be2-ac81ac5f6e80.png
  Captured: 2026-10-25 14:24:00 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a15c03-6528-7649-8be2-ac81ac5f6e80.png
  Captured: 2026-10-26 04:30:27 UTC
  Source report: https://urlscan.io/result/01a15c03-6528-7649-8be2-ac81ac5f6e80/
- URLScan · 2026-08-19: https://screenshots.phishdestroy.io/us/01a01848-0477-710a-a64d-b6b6619f379c.png
  Captured: 2026-08-19 04:29:34 UTC
  Source report: https://urlscan.io/result/01a01848-0477-710a-a64d-b6b6619f379c/
  SHA-256: 7c243618d588e40d8fe3eb20935135f371bb0ac5c6c66e3e3e4d557ed939cd7b
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04b78-eadd-7722-8fc5-4cb7d8949704.png
  Captured: 2026-08-29 03:03:37 UTC
  Source report: https://urlscan.io/result/01a04b78-eadd-7722-8fc5-4cb7d8949704/
  SHA-256: 7c243618d588e40d8fe3eb20935135f371bb0ac5c6c66e3e3e4d557ed939cd7b
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05b59-723e-751b-9e18-a207ce29ea01.png
  Captured: 2026-09-01 05:03:11 UTC
  Source report: https://urlscan.io/result/01a05b59-723e-751b-9e18-a207ce29ea01/
  SHA-256: 7c243618d588e40d8fe3eb20935135f371bb0ac5c6c66e3e3e4d557ed939cd7b
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e1e1-6710-753b-ab41-ca9c365edd24.png
  Captured: 2026-09-27 08:00:56 UTC
  Source report: https://urlscan.io/result/01a0e1e1-6710-753b-ab41-ca9c365edd24/
  SHA-256: 7c243618d588e40d8fe3eb20935135f371bb0ac5c6c66e3e3e4d557ed939cd7b
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3f708fcb-578e-4bde-ade8-7e059d3def89.png
  Captured: 2026-10-25 14:26:16 UTC
  Source report: https://radar.cloudflare.com/scan/3f708fcb-578e-4bde-ade8-7e059d3def89
  SHA-256: e31dfa51a793957a5234bd365a3d54f662dcf6c853d83c97a336a6f5469f2a0c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T14:27:31Z",
        "uuid": "01a15c03-6528-7649-8be2-ac81ac5f6e80",
        "scanned_at": "2026-10-21T01:11:35Z",
        "final_url": "https://early-upright-mongrel.edgecompute.app/",
        "status": 200,
        "ip": "2a04:4e42:400::307",
        "domains": [
            "cdn.tailwindcss.com",
            "via.placeholder.com"
        ],
        "ips": [
            "188.114.97.3",
            "2606:4700:20::681a:38f",
            "2a04:4e42:400::307"
        ],
        "asns": [
            "13335",
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "b5a10b7423ff558c710ecb0d105ecab1b0c6eacf2600d1dc55ec9d8da14b89ac",
        "globals": [
            "tailwind",
            "/template.html",
            "updateLogoByEmail",
            "autoGrabEmail",
            "goToPasswordStep",
            "goBackToEmail",
            "togglePassword",
            "handleLogin",
            "logoMap"
        ],
        "tls": {
            "san": [
                "*.edgecompute.app",
                "edgecompute.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "GlobalSign Atlas R46 DV TLS CA 2026 Q3",
            "subject": "*.edgecompute.app",
            "protocol": "TLS 1.3",
            "valid_to": "2027-04-06T14:23:03Z",
            "valid_from": "2026-09-19T15:23:03Z"
        },
        "domain_age_days": 434,
        "apex_age_days": 434,
        "tls_age_days": 31,
        "tls_valid_days": 198,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericemail"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Email"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T14:27:32Z",
        "uuid": "3f708fcb-578e-4bde-ade8-7e059d3def89",
        "scanned_at": "2026-10-25T14:26:16Z",
        "final_url": "https://early-upright-mongrel.edgecompute.app/",
        "status": 200,
        "history": [
            {
                "url": "https://early-upright-mongrel.edgecompute.app/",
                "status": 200
            }
        ],
        "dom_hash": "7fc439af9c7cc0ec3e9404ffc2051b7d063a27d0f943efd2cb388abf8b3d7f57",
        "doc_hash": "b5a10b7423ff558c710ecb0d105ecab1b0c6eacf2600d1dc55ec9d8da14b89ac",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "early-upright-mongrel.edgecompute.app",
                "type": "CNAME",
                "value": "ecp.map.fastly.net"
            },
            {
                "name": "early-upright-mongrel.edgecompute.app",
                "type": "CNAME",
                "value": "ecp.map.fastly.net"
            }
        ],
        "dnssec_valid": false,
        "ip": "151.101.193.51",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2019-09-26T17:20:49Z",
            "updated": "2026-09-01T16:21:58Z",
            "expires": "2027-09-26T17:20:49Z",
            "nameservers": [
                "cherry.fastlydns.com",
                "cherry.fastlydns.dev",
                "cherry.fastlydns.net",
                "cherry.fastlydns.org",
                "ns-cloud-a1.googledomains.com",
                "ns-cloud-a2.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T14:25:31Z",
        "analysis_at": "2026-10-01T11:15:01Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 15,
            "suspicious": 0,
            "undetected": 31
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "ADMINUSLabs": "malicious",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "web infrastructure"
        },
        "registrar": "MarkMonitor Inc.",
        "created": "2019-09-26T17:20:49Z",
        "expires": "2025-09-26T17:20:49Z",
        "updated": "2023-07-17T19:14:27Z",
        "first_seen": "2025-08-13T20:59:43Z",
        "dns": [
            {
                "ttl": 60,
                "type": "A",
                "value": "151.101.193.51"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "151.101.65.51"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "151.101.1.51"
            },
            {
                "ttl": 60,
                "type": "AAAA",
                "value": "2a04:4e42:400::307"
            },
            {
                "ttl": 60,
                "type": "AAAA",
                "value": "2a04:4e42::307"
            },
            {
                "ttl": 60,
                "type": "AAAA",
                "value": "2a04:4e42:600::307"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "151.101.129.51"
            },
            {
                "ttl": 3600,
                "type": "CNAME",
                "value": "ecp.map.fastly.net"
            },
            {
                "ttl": 60,
                "type": "AAAA",
                "value": "2a04:4e42:200::307"
            }
        ],
        "dns_at": "2026-10-01T11:20:44Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.edgecompute.app",
                "edgecompute.app"
            ],
            "issuer": "GlobalSign nv-sa / GlobalSign Atlas R46 DV TLS CA 2026 Q3",
            "serial": "15d35336b94e33cb4d332c9471aa014",
            "sha256": "282b40f5c94a84add2b04b21ae583ba0472d53316b716e67c3637e81e1593813",
            "subject": "*.edgecompute.app",
            "valid_to": "2027-04-06T14:23:03Z",
            "valid_from": "2026-09-19T15:23:03Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2019-09-26T17:20:49Z",
            "updated": "2023-07-17T19:14:27Z",
            "expires": "2025-09-26T17:20:49Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "edns1.ultradns.biz",
                "edns1.ultradns.com",
                "edns1.ultradns.net",
                "edns1.ultradns.org",
                "ns-cloud-a1.googledomains.com",
                "ns-cloud-a2.googledomains.com",
                "ns-cloud-a3.googledomains.com",
                "ns-cloud-a4.googledomains.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T14:27:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "count": 3,
            "domain": "edgecompute.app",
            "issuers": [
                "letsencrypt.org",
                "globalsign.com"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "social_tags": {
            "title": "Auto Login"
        },
        "trackers": {
            "requests": 4
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.tailwindcss.com/"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 9,
                "tls": 16,
                "wait": 45,
                "connect": 10,
                "download": 3
            },
            "response_ms": 83
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "ocsp_stapled": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 14185,
            "co2_grams": 0.0005,
            "cleaner_than": 64
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "157.52.79.2",
                    "host": "cherry.fastlydns.dev"
                },
                {
                    "ip": "167.82.229.2",
                    "host": "cherry.fastlydns.org"
                },
                {
                    "ip": "216.239.32.106",
                    "host": "ns-cloud-a1.googledomains.com"
                },
                {
                    "ip": "216.239.34.106",
                    "host": "ns-cloud-a2.googledomains.com"
                },
                {
                    "ip": "157.52.78.2",
                    "host": "cherry.fastlydns.com"
                },
                {
                    "ip": "167.82.228.2",
                    "host": "cherry.fastlydns.net"
                }
            ],
            "zone": "edgecompute.app"
        },
        "location": {
            "ip": "2a04:4e42:8e::307",
            "asn": "54113",
            "org": "Fastly, Inc.",
            "city": "Frankfurt am Main",
            "country": "DE"
        },
        "ssl": {
            "issuer": "GlobalSign nv-sa / GlobalSign Atlas R46 DV TLS CA 2026 Q3",
            "subject": "*.edgecompute.app"
        },
        "dns": {
            "A": [
                "146.75.121.51"
            ],
            "AAAA": [
                "2a04:4e42:8e::307"
            ],
            "CNAME": [
                "ecp.map.fastly.net"
            ]
        },
        "dnssec": {
            "ds": true,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "2a04:4e42:8e::307",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://early-upright-mongrel.edgecompute.app"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html"
            }
        }
    }
}
```