mhsappsignin-j1oq4zb0hi[.]edgeone[.]app

This domain, mhsappsignin-j1oq4zb0hi.edgeone.app, is flagged as a brand impersonation phishing site targeting Google. The page title, "Sign in - Google Accounts," and visual design closely mimic legitimate Google authentication portals, indicating an intent to harvest credentials. No drainer kit signatures were identified in initial scans, but the domain exhibits characteristics consistent with credential theft infrastructure. Analysis suggests the threat actor leveraged a subdomain under edgeone.app to evade detection and exploit trust in cloud-based hosting services. Infrastructure analysis reveals the domain resolves to 43.152.26.58 (AS139341, Germany) and was registered through MarkMonitor, Inc. on February 21, 2026, an anomalous future date likely indicative of falsified registration data. VirusTotal indicates 25 out of 95 security vendors flagged this domain as malicious, while it appears on one security blocklist (PhishDestroy). The SSL certificate, issued by DigiCert (Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1), is valid but does not mitigate the phishing risk, as attackers frequently abuse legitimate certificates to enhance perceived legitimacy. The domain is currently offline, reducing immediate risk of active exploitation. However, the infrastructure remains registered and could be reactivated. Historical DNS records and cached content may still pose a residual threat to users who interacted with the domain prior to takedown. Organizations are advised to monitor for references to this domain in logs, block the IP address 43.152.26.58, and update detection rules to include the domain and its subdomains. Users should be alerted to verify URLs before entering credentials, particularly for services mimicking Google authentication flows.