rare-blue-d4nhaptpng[.]edgeone[.]app

This domain is flagged as an elevated-risk credential harvesting phishing site. Analysis indicates the infrastructure is specifically designed to mimic email login portals, as evidenced by the page title 'MAIL' and the domain's association with phishing campaigns targeting corporate and personal email accounts. The threat type is classified as generic_phishing with a focus on credential theft, a common tactic for initial access in cyber intrusions or account takeovers. Infrastructure analysis reveals the domain rare-blue-d4nhaptpng.edgeone.app is registered through Tencent EdgeOne and resolves to the IP address 43.152.26.58. Security vendors on VirusTotal flagged the domain in 23 out of 95 scans, indicating moderate but consistent detection. The domain appears on one security blocklist, suggesting prior malicious activity. The SSL certificate, issued by DigiCert, Inc. (DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1), is legitimate but does not mitigate the phishing risk, as attackers frequently abuse trusted certificate authorities to lend credibility to malicious sites. The domain is currently offline, but historical activity and detection patterns warrant continued monitoring. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (43.152.26.58) at the network perimeter. Organizations should implement multi-factor authentication (MFA) for all email and critical accounts to reduce the impact of credential theft. End-users should be trained to recognize phishing indicators, such as suspicious domain names (e.g., edgeone.app subdomains with randomized prefixes) and urgent login prompts. Security teams are advised to review logs for connections to 43.152.26.58 or the domain name and investigate any potential credential exposure. If credentials were entered on this site, they should be reset immediately, and affected accounts should be monitored for unauthorized access.