awsforensicl3ns-west1apprunner-dprd03feve9j[.]edgeone[.]dev

The domain awsforensicl3ns-west1apprunner-dprd03feve9j.edgeone.dev is presently active and has been identified as a generic phishing infrastructure. DNS resolution points to the IPv4 address 43.174.247.29, which is hosted by Tencent Cloud, as indicated by the registrar information. The domain’s authoritative name server data could not be retrieved (NS_NOT_FOUND), suggesting that the attacker may be using dynamic or obscured DNS configurations to evade enumeration. Threat intelligence platforms have recorded twelve positive detections out of ninety‑one vendors on VirusTotal, confirming that a notable minority of security products recognize malicious characteristics associated with this host. Additionally, the domain appears on a single external blocklist, and it has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing vector. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content and delivery mechanisms of the phishing page unverified. Consequently, defenders should prioritize immediate containment actions: add the domain and its resolving IP address to network‑level deny lists, enforce DNS‑level blocking for the .edgeone.dev suffix, and monitor outbound traffic for connections to 43.174.247.29. Continuous re‑scanning with multiple sandbox and reputation services is advisable to capture any evolution of the payload or additional detection signatures. Organizations that rely on Tencent Cloud services should also verify any internal resources that might be inadvertently leveraged for malicious hosting, and consider employing outbound traffic filtering to restrict access to newly observed malicious endpoints.