# PhishDestroy domain threat record: gemini-free-argon-dp84s3xa3qjs.edgeone.dev

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gemini-free-argon-dp84s3xa3qjs.edgeone.dev/
Machine-readable companion: https://phishdestroy.io/domain/gemini-free-argon-dp84s3xa3qjs.edgeone.dev/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 19:47:07 UTC
- Last availability or vendor check: 2026-10-27 23:00:27 UTC
- Stored record updated: 2026-10-27 23:30:58 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 43.174.246.29
- Registrar in stored WHOIS data: MarkMonitor Inc.
- Last stored HTTP status: 200
- Registration date (registry RDAP, edgeone.dev): 2025-06-09 07:01:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1535b-da45-759e-b395-985a6ee04fdf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gemini-free-argon-dp84s3xa3qjs.edgeone.dev
- Certificate Transparency search: https://crt.sh/?q=%25.gemini-free-argon-dp84s3xa3qjs.edgeone.dev
- Web Archive lookup: https://web.archive.org/web/*/https://gemini-free-argon-dp84s3xa3qjs.edgeone.dev/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added gemini-free-argon-dp84s3xa3qjs.edgeone.dev to its internal blocklist on 2026-10-27 following a trusted intake that noted insufficient page content for a definitive analysis. The recorded page title was “Please wait…” and an HTTP 200 response was observed on that date.

How the scam works
The listing and detections do not establish a specific malicious mechanism; they indicate a risk category where sites may be used to deceive visitors without confirming the exact scheme. The observed page context is limited to a generic title and no confirmed user input.

Evidence
VirusTotal scanned the domain on 2026-10-19 and reported six malicious detections out of 92 engines, with vendors Gridinsoft, LevelBlue, SOCRadar, VIPRE, Webroot and Yandex Safebrowsing flagging it as phishing or malicious. Google Safe Browsing checked on 2026-10-27 and did not flag the URL. urlscan.io captured the page on 2026-10-19 and its machine‑learning engine assigned a malicious score of 78, while its overall verdict was non‑malicious; Cloudflare Radar on 2026-10-27 marked the domain as phishing. OTX listed zero pulses and external blocklists reported no matches on 2026-10-27, while PhishDestroy’s own list marks the domain as blocked.

Infrastructure
The recorded IP addresses associated with the domain were 43.174.246.29 and 43.174.247.29, both assigned to Aceville Pte. Ltd. in Singapore. The recorded TLS certificate was issued by Let’s Encrypt under YR1 and valid until 2026-12-16. DNS records showed a CNAME to 2354db541df20c20.edgeone.dev.pages.dnsoe6.com and authoritative nameservers ns3.dnsv2.com and ns4.dnsv2.com.

What to do
Visitors should avoid entering any credentials or personal information on the site and, if they have already done so, change affected passwords immediately. Security teams can block the exact domain in perimeter defenses and monitor logs for any connections to the listed infrastructure. Continue to watch reputable threat feeds for any updates on the domain’s activity.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1535b-da45-759e-b395-985a6ee04fdf/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8d87ebfe-2ef4-4601-920d-e453b6acc819
Stored capture screenshot: https://urlscan.io/screenshots/01a1535b-da45-759e-b395-985a6ee04fdf.png
Cloudflare Radar screenshot (2026-10-27T19:57:49Z): https://screenshots.phishdestroy.io/cf/8d87ebfe-2ef4-4601-920d-e453b6acc819.png
VirusTotal report: https://www.virustotal.com/gui/domain/gemini-free-argon-dp84s3xa3qjs.edgeone.dev
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gemini-free-argon-dp84s3xa3qjs.edgeone.dev
Archived copy: https://web.archive.org/web/20261027195123/https://gemini-free-argon-dp84s3xa3qjs.edgeone.dev/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 20:30:14 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1535b-da45-759e-b395-985a6ee04fdf.png
  Captured: 2026-10-27 19:47:07 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1535b-da45-759e-b395-985a6ee04fdf.png
  Source report: https://urlscan.io/result/01a1535b-da45-759e-b395-985a6ee04fdf/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8d87ebfe-2ef4-4601-920d-e453b6acc819.png
  Captured: 2026-10-27 19:57:49 UTC
  Source report: https://radar.cloudflare.com/scan/8d87ebfe-2ef4-4601-920d-e453b6acc819
  SHA-256: b67d39094942cf5c7f7af30e1e9c9f8ab5161c3790206ba5fbd55a6fb565a174

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T20:00:53Z",
        "uuid": "01a1535b-da45-759e-b395-985a6ee04fdf",
        "scanned_at": "2026-10-19T08:51:39Z",
        "final_url": "https://gemini-free-argon-dp84s3xa3qjs.edgeone.dev/",
        "status": 200,
        "ip": "43.174.246.29",
        "domains": [
            "api.telegram.org",
            "ipapi.co"
        ],
        "ips": [
            "149.154.166.110",
            "172.67.69.226",
            "43.174.246.29"
        ],
        "asns": [
            "62041",
            "13335",
            "139341"
        ],
        "countries": [
            "NL",
            "SG"
        ],
        "doc_hash": "572a58d2899db4831238b3d495b4d9362aa04bfc24a1d35759826bc55b3c4c8c",
        "globals": [
            "fetchJSON",
            "normalize",
            "lookupIP",
            "parseUA",
            "gpuRenderer",
            "collectClient",
            "buildMessage",
            "sendTelegram",
            "CONFIG",
            "esc"
        ],
        "tls": {
            "san": [
                "*.edgeone.dev",
                "edgeone.dev"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "edgeone.dev",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-16T02:52:53Z",
            "valid_from": "2026-09-17T02:52:54Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 1432,
        "tls_age_days": 32,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 78,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "edgeone makers",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T20:00:55Z",
        "uuid": "8d87ebfe-2ef4-4601-920d-e453b6acc819",
        "scanned_at": "2026-10-27T19:57:49Z",
        "final_url": "https://gemini-free-argon-dp84s3xa3qjs.edgeone.dev/",
        "status": 200,
        "history": [
            {
                "url": "https://gemini-free-argon-dp84s3xa3qjs.edgeone.dev/",
                "status": 200
            }
        ],
        "dom_hash": "99e38ab3b4bce391267f07b832a4361a84a680ca608af3eca063a1a8e3530f89",
        "doc_hash": "572a58d2899db4831238b3d495b4d9362aa04bfc24a1d35759826bc55b3c4c8c",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gemini-free-argon-dp84s3xa3qjs.edgeone.dev",
                "type": "CNAME",
                "value": "2354db541df20c20.edgeone.dev.pages.dnsoe6.com"
            },
            {
                "name": "gemini-free-argon-dp84s3xa3qjs.edgeone.dev",
                "type": "CNAME",
                "value": "2354db541df20c20.edgeone.dev.pages.dnsoe6.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.4",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2025-06-09T07:01:06Z",
            "updated": "2025-10-08T23:26:13Z",
            "expires": "2027-06-09T07:01:06Z",
            "nameservers": [
                "ns3.dnsv2.com",
                "ns4.dnsv2.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T20:27:01Z",
        "analysis_at": "2026-10-19T10:10:53Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 6,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "VIPRE": "phishing",
            "Webroot": "malicious",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "Yandex Safebrowsing": "phishing"
        },
        "reputation": 0,
        "created": "2025-06-09T00:00:00Z",
        "updated": "2025-06-09T00:00:00Z",
        "first_seen": "2026-10-19T09:22:37Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "43.174.246.29"
            },
            {
                "ttl": 600,
                "type": "CNAME",
                "value": "2354db541df20c20.edgeone.dev.pages.dnsoe6.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "43.174.247.29"
            }
        ],
        "dns_at": "2026-10-19T10:16:16Z",
        "jarm": "2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920",
        "cert": {
            "san": [
                "*.edgeone.dev",
                "edgeone.dev"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5fb70cbb59204334541800ff2e61c87889d",
            "sha256": "6d538285ba8e76e272733030941a0f13d96a5ad70d8ff34789947928afe7b1fa",
            "subject": "edgeone.dev",
            "valid_to": "2026-12-16T02:52:53Z",
            "valid_from": "2026-09-17T02:52:54Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T20:01:07Z",
        "caa_records": {
            "domain": "gemini-free-argon-dp84s3xa3qjs.edgeone.dev"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T19:51:23Z",
            "first": "2026-10-27T19:51:23Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4517
        },
        "social_tags": {
            "title": "Please wait…"
        },
        "trackers": {
            "requests": 5,
            "trackers": [
                {
                    "name": "ipify",
                    "company": "ipify",
                    "category": "Misc",
                    "requests": 1
                },
                {
                    "name": "ipapi",
                    "company": "Kloudend",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 27,
                "tls": 19,
                "wait": 142,
                "connect": 54,
                "download": 0
            },
            "response_ms": 242
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 8239,
            "co2_grams": 0.0003,
            "cleaner_than": 76
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "101.227.168.55",
                    "host": "ns4.dnsv2.com"
                },
                {
                    "ip": "220.196.136.55",
                    "host": "ns3.dnsv2.com"
                }
            ],
            "zone": "edgeone.dev"
        },
        "location": {
            "ip": "43.174.247.29",
            "asn": "139341",
            "org": "Aceville Pte.ltd.",
            "city": "Singapore",
            "country": "SG"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "edgeone.dev"
        },
        "dns": {
            "A": [
                "43.174.247.29",
                "43.174.246.29"
            ],
            "CNAME": [
                "2354db541df20c20.edgeone.dev.pages.dnsoe6.com"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "43.174.247.29",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://gemini-free-argon-dp84s3xa3qjs.edgeone.dev"
            ]
        },
        "headers": {
            "headers": {
                "server": "edgeone makers",
                "content-type": "text/html"
            }
        }
    }
}
```