gastric-rose-hwpw4awz[.]edgeone[.]dev

This domain, gastric-rose-hwpw4awz.edgeone.dev, is currently active and operating as a credential harvesting endpoint. Analysis indicates it is designed to impersonate legitimate login portals to exfiltrate user credentials and session tokens. The infrastructure hosting this domain is configured to mimic trusted authentication interfaces, increasing the likelihood of successful deception. Detection metrics reveal consistent blocking activity across multiple security platforms, with 23 of 95 engines flagging the domain as malicious.

Infrastructure analysis reveals the domain resolves to IP address 43.174.246.29, which is associated with high-risk hosting environments. The domain was created recently, with no historical registration data indicating prior legitimate use. The low detection count relative to the total engines queried suggests either a newly deployed campaign or evasion techniques designed to bypass initial screening. Given the combination of active status and high-risk infrastructure alignment, this domain poses a significant threat to users accessing web-based authentication services.

Users who have visited this domain should immediately audit their credentials for potential compromise, particularly if any login attempts were made. Disconnect from untrusted networks and scan local systems for unauthorized access or credential storage modifications. Report any suspicious account activity to relevant service providers and consider implementing multi-factor authentication where available. Network administrators should block this domain and its associated IP address at the firewall level to prevent further exposure. Maintain heightened monitoring for related domains or infrastructure indicators to mitigate ongoing risk.