comparable-beige-ghqsab8y[.]edgeone[.]dev

The domain comparable-beige-ghqsab8y.edgeone.dev was observed hosting a page titled “Tencent Edgeone” before being taken offline. DNS resolution points to the IPv4 address 43.174.246.29, which belongs to ASN 139341 (ACE) and is geolocated in Singapore. The domain is served behind Cloudflare, as indicated by the presence of Cloudflare‑related headers and the use of HSTS, and the page content was built with Bootstrap, jQuery and the cdnjs CDN library. The SSL certificate is issued by DigiCert Secure Site OV G2 TLS, uses a 4096‑bit RSA key, and was valid as of the 2022 issuance, confirming a legitimate certificate chain but offering no guarantee of benign intent.

VirusTotal recorded 15 detections out of 91 scanning engines, and the domain appears on a single external blocklist, suggesting that multiple security vendors have flagged it as malicious. Additional reputation signals include a Gridinsoft trust score of 0 / 100 and a block by the PhishDestroy feed, both indicating high confidence of abuse. The registrar listed is MarkMonitor Inc., a well‑known registrar often used by large enterprises, which may reflect an attempt to lend credibility. Nameserver configuration uses ns3.dnsv2.com and ns4.dnsv2.com, consistent with the observed hosting environment.

HTTP response returned a 404 status, and the site is currently offline, limiting immediate analysis of payloads or credential‑stealing forms. Defenders should continue to block the IP address 43.174.246.29 and the domain itself at perimeter and DNS layers, update any URL filtering solutions with the domain and its associated hostnames, and monitor for any resurgence of the domain or related subdomains. Given the limited public artifacts, threat hunters should query internal logs for any outbound connections to the IP or TLS handshakes involving the DigiCert certificate fingerprint, and review authentication logs for attempts to interact with services that might be mimicking Tencent.