soft-teal-juqugdes[.]edgeone[.]app

This domain, soft-teal-juqugdes.edgeone.app, is flagged as an elevated-risk credential harvesting phishing site. Analysis indicates the infrastructure was designed to mimic legitimate email update portals, a common tactic for stealing user credentials and sensitive corporate data. The threat type is highly specific, targeting users through deceptive login prompts under the guise of an 'Email Update' page, which aligns with known phishing campaigns aimed at enterprise environments. Infrastructure analysis reveals the domain was registered through Tencent EdgeOne and resolved to the IP address 101.33.10.10. Security vendors on VirusTotal detected the domain as malicious, with 11 out of 95 flagging it for phishing-related activity. The domain appears on at least one security blocklist and was proactively blocked by enterprise-grade filtering systems. The SSL certificate, issued by DigiCert, Inc., does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. Gridinsoft assigned a trust score of 0/100, further confirming its malicious nature. The domain is currently offline, but historical data suggests it was operational long enough to pose a significant threat. Mitigation steps for organizations include immediate blocking of the domain and its associated IP (101.33.10.10) at the network perimeter. Security teams should conduct a retrospective analysis of logs to identify any interactions with the domain, particularly from users who may have entered credentials. Employee training should emphasize recognizing phishing tactics, such as unexpected 'Email Update' prompts, and verifying the legitimacy of such requests through secondary channels. Additionally, organizations should monitor for similar domains registered under Tencent EdgeOne or resolving to the same IP range, as threat actors often reuse infrastructure for subsequent campaigns.