controlled-harlequin-cx5tepts[.]edgeone[.]dev

This domain, controlled-harlequin-cx5tepts.edgeone.dev, is flagged as a high-risk credential harvesting phishing site. Analysis indicates the infrastructure is designed to deceive users into submitting sensitive authentication credentials through a fraudulent 'Account Verification' portal. The threat specifically targets individuals by impersonating legitimate account validation processes, a common tactic in credential theft campaigns. Infrastructure analysis reveals the domain resolves to the IP address 43.174.247.29 and is currently active. Detection metrics from aggregated security platforms show 20 out of 95 engines have identified the domain as malicious. The domain appears on at least one security blocklist, further corroborating its malicious classification. The registrar details, while obscured through the edgeone.dev subdomain structure, suggest leveraging of a legitimate content delivery network to evade initial scrutiny. No creation date metadata is publicly available due to the subdomain delegation, but the active status and detection rates indicate recent deployment. Mitigation against this specific threat requires immediate action from network administrators and end-users. Network-level protections should include blocking the IP address 43.174.247.29 and implementing domain-based filtering for controlled-harlequin-cx5tepts.edgeone.dev. End-users should be educated to recognize phishing indicators, such as unexpected account verification requests and mismatched URLs. Multi-factor authentication should be enforced to mitigate the impact of credential theft. Security teams are advised to monitor for related indicators of compromise, including the use of the same IP or similar subdomain patterns under edgeone.dev, as this infrastructure may be reused across multiple campaigns.