kjhgrtykbhj-dpnfz9dllbs3[.]edgeone[.]cool

The domain kjhgrtykbhj-dpnfz9dllbs3.edgeone.cool has been identified as a credential harvesting phishing resource targeting users through deceptive login interfaces. Analysis confirms the domain is currently offline, though it previously exhibited active malicious behavior designed to extract sensitive authentication details. No specific brand impersonation has been conclusively linked to this domain at the time of reporting, though its infrastructure aligns with common phishing tactics. Infrastructure analysis reveals the domain was flagged by 19 of 95 security vendors on a widely used detection platform, indicating broad consensus regarding its malicious nature. The domain resolves to the IP address 43.174.246.29 and was registered through DNSPod, Inc., a registrar frequently associated with abusive domains. It appears on two security blocklists, further corroborating its classification as a phishing resource. The SSL certificate is issued by DigiCert, Inc., which, while not inherently indicative of malicious activity, is commonly exploited in phishing campaigns to lend a false sense of legitimacy. Additional technical indicators include the use of Bootstrap, Cloudflare, jQuery CDN, Google Hosted Libraries, cdnjs, Axios, and Popper, all of which are standard components in modern web development but are also leveraged in phishing kits to enhance functionality and evade detection. A trust score of 0 out of 100 from an independent security assessment platform underscores the domain’s high-risk classification. As of the latest verification, the domain has been taken offline, reducing immediate exposure risks. However, organizations and users are advised to maintain vigilance, as threat actors may reactivate similar domains or shift infrastructure to evade mitigation efforts. Network administrators should ensure the IP address 43.174.246.29 and the domain kjhgrtykbhj-dpnfz9dllbs3.edgeone.cool are blocked at the perimeter level. Users who may have interacted with this domain should immediately rotate credentials for any accounts accessed during the exposure window. Continuous monitoring of related infrastructure, including newly registered domains under the same registrar or resolving to the same IP range, is recommended to preempt potential follow-up campaigns.