ezeserverlogin-dptabl94lu7z[.]edgeone[.]dev

Analysis of ezeserverlogin-dptabl94lu7z.edgeone.dev, a domain created on June 15 2026 and currently taken offline, identifies a credential‑phishing threat. The domain resolves to the IPv4 address 43.174.247.29, which is allocated to ASN 139341, registered to ACE in Singapore. Hosting is fronted by Cloudflare, as indicated by the presence of Cloudflare services in the technology fingerprint. The TLS certificate, issued by DigiCert Secure Site OV G2 with a RSA‑4096 key and a SHA‑256 signature, is valid for the host and confirms the domain’s use of HTTPS, though the HTTP response returns a 404 status, suggesting the malicious page is no longer publicly reachable.

The page title returned from the last probe is "Web Mail," matching the declared scam type of credential phishing. Supporting infrastructure includes jQuery CDN, Google Hosted Libraries, cdnjs and Popper, alongside IPinfo and HSTS headers, which are typical of sites that collect user credentials. The domain is registered via MarkMonitor Inc. and uses the nameservers ns3.dnsv2.com and ns4.dnsv2.com. Reputation signals are overwhelmingly negative: Gridinsoft assigns a trust score of 0 / 100, VirusTotal records 18 detections out of 91 scanned scanners, and the domain appears on at least one public blocklist.

It is also listed by PhishDestroy as blocked. Uncertainty remains regarding the exact content of the now‑offline page, as no visual or form details have been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address or associated nameservers, and consider sharing the indicator set with threat‑intel communities to aid broader detection.