sandagdorx-dpg96yps2wp6[.]edgeone[.]dev

Analysis of the domain sandagdorx-dpg96yps2wp6.edgeone.dev, observed on 2026-08-03, indicates that it is actively used for generic phishing campaigns. VirusTotal reports that eight of ninety-one scanning engines have flagged the host as malicious, demonstrating a moderate level of consensus among security vendors. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that defensive communities have identified it as a threat.

No additional public data such as registrar details, IP address, ASN, or SSL certificate information is currently available in the shared intelligence, and the page title or any associated brand references have not been disclosed. Consequently, the full scope of the infrastructure—hosting provider, geographic location, and underlying phishing kit—remains uncertain. The elevated risk rating reflects the combination of vendor detections and active blocklist inclusion, despite the limited breadth of open-source evidence.

Defenders should add sandagdorx-dpg96yps2wp6.edgeone.dev to local deny lists, ensure that URL filtering solutions reference the PhishDestroy blocklist, and monitor outbound traffic for connections to the domain. Continuous re-evaluation is advised, as further analysis may reveal additional indicators such as hosting IPs, TLS fingerprints, or malicious payloads that could refine detection rules.