webmail-onehealth-ca-groupoffice-9o6ir1yhw8[.]edgeone[.]cool

The domain webmail-onehealth-ca-groupoffice-9o6ir1yhw8.edgeone.cool was identified as a generic phishing portal designed to impersonate secure email login interfaces. Analysis indicates the site specifically targeted enterprise users by presenting a fraudulent authentication page titled Email Portal Access | Secure Digital Platform. The domain is currently offline, though prior activity suggests credential harvesting as the primary objective. Infrastructure analysis reveals the domain was registered through DNSPod, Inc. and resolved to the IP address 43.174.246.29. It appears on one security blocklist and holds a Gridinsoft trust score of 0/100, indicating high-risk classification. VirusTotal records show 19 of 95 security vendors flagged the domain as malicious. The SSL certificate was issued by DigiCert, Inc., and the site employed common front-end technologies including Bootstrap, Cloudflare, Font Awesome, cdnjs, and Popper, likely to enhance the appearance of legitimacy. Current status confirms the domain has been taken offline, though residual risks may persist. Organizations are advised to monitor for credential reuse attempts, particularly from users who may have interacted with the site prior to its deactivation. Network administrators should block the IP address 43.174.246.29 and implement email filtering rules to prevent delivery of messages containing links to the domain. Security teams are recommended to review authentication logs for anomalous access patterns and enforce multi-factor authentication for all enterprise accounts as a preventive measure.