extra-cyan-zfxl6ma9.edgeone.app
43.168.176.154  Malicious Activity! Public Scan Open in urlscan Pro

URL:
https://extra-cyan-zfxl6ma9.edgeone.app/ 1mo old
Submission Tags: @phish_report
Submission: On June 11 via api (June 11th 2026, 12:34:13 pm UTC) from FI — Scanned from SG

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 9 HTTP transactions. The main IP is 43.168.176.154, located in Singapore and belongs to ACE-AS-AP - ACE, SG. The main domain is extra-cyan-zfxl6ma9.edgeone.app. 1mo old
TLS certificate: Issued by DigiCert Secure Site OV G2 TLS CN RSA... on November 17th 2025. Valid for: 1yr.
This is the only time extra-cyan-zfxl6ma9.edgeone.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 43.168.176.154 43.168.176.154 139341 (ACE-AS-AP) (ACE-AS-AP - ACE)
1 2404:6800:400... 2404:6800:4003:c05::5f 15169 (GOOGLE) (GOOGLE - Google LLC)
2 2a04:4e42:200... 2a04:4e42:200::411 54113 (FASTLY) (FASTLY - Fastly)
1 104.17.25.14 104.17.25.14 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 3.222.219.55 3.222.219.55 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 34.117.59.81 34.117.59.81 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
9 7
Apex Domain
Subdomains
Transfer
2 jquery.com
code.jquery.com — Cisco Umbrella Rank: 784 13yr old
108 KB
2 edgeone.app
extra-cyan-zfxl6ma9.edgeone.app 1mo old
5 KB
1 ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 3845 13yr old
319 B
1 thum.io
image.thum.io — Cisco Umbrella Rank: 434220 7yr old
21 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 262 13yr old
7 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 571 10yr old
30 KB
0 clearbit.com Failed
logo.clearbit.com Failed 9yr old
9 7
Domain Requested by
2 code.jquery.com extra-cyan-zfxl6ma9.edgeone.app
2 extra-cyan-zfxl6ma9.edgeone.app
1 ipinfo.io extra-cyan-zfxl6ma9.edgeone.app
1 image.thum.io extra-cyan-zfxl6ma9.edgeone.app
1 cdnjs.cloudflare.com extra-cyan-zfxl6ma9.edgeone.app
1 ajax.googleapis.com extra-cyan-zfxl6ma9.edgeone.app
0 logo.clearbit.com Failed extra-cyan-zfxl6ma9.edgeone.app
9 7

This site contains no links.

Subject Issuer Validity Valid
*.edgeone.app
DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1
2025-11-17 -
2026-11-16
1yr crt.sh
upload.video.google.com
WR2
2026-05-18 -
2026-08-10
3mo crt.sh
*.jquery.com
Sectigo Public Server Authentication CA DV E36
2026-05-20 -
2026-12-04
7mo crt.sh
cdnjs.cloudflare.com
WE1
2026-05-12 -
2026-08-10
3mo crt.sh
thum.io
Amazon RSA 2048 M04
2026-06-05 -
2026-12-19
7mo crt.sh
ipinfo.io
R12
2026-05-03 -
2026-08-01
3mo crt.sh

This page contains 1 frames:

Primary Page: https://extra-cyan-zfxl6ma9.edgeone.app/
Frame ID: 1076E187F6BA4385402346A98A1750E7
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Web Mail

Detected technologies

(CDN)
Overall confidence: 100%
Detected patterns
  • cdnjs\.cloudflare\.com

(CDN)
Overall confidence: 100%
Detected patterns
  • ajax\.googleapis\.com/ajax/libs/

(Geolocation)
Overall confidence: 100%
Detected patterns
  • ipinfo\.io/

(JavaScript libraries)
Overall confidence: 100%
Detected patterns
  • jquery
  • /(\d+\.\d+\.\d+)/jquery(?!\.popupoverlay\.js|(?:\.[\w-]*)*fancybox)[/.-][^u]
  • /jquery(?:-(\d+\.\d+\.\d+))[/.-]

(CDN)
Overall confidence: 100%
Detected patterns
  • code\.jquery\.com/

(Miscellaneous)
Overall confidence: 100%
Detected patterns
  • /popper(?:\.min)?\.js(?:/([0-9.]+))?

Page Statistics

9
Requests

89 %
HTTPS

33 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

172 kB
Transfer

491 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H2
200
Primary Request / Show response
extra-cyan-zfxl6ma9.edgeone.app/
13 KB
4 KB
429ms
19ms
Document
text/html
43.168.176.154
ACE
General
Full URL
https://extra-cyan-zfxl6ma9.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.168.176.154 , Singapore, ASN139341 (ACE-AS-AP - ACE, SG),
Reverse DNS
Software
edgeone-pages /
Resource Hash
eb2bddec8290192e727d70f1180abfbf213f38e7f8ee35618ab2c5f363893bbf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

accept-ranges
bytes
age
118816
cache-control
public,max-age=0,must-revalidate
content-encoding
br
content-length
3655
content-type
text/html
date
Thu, 11 Jun 2026 12:34:14 GMT
eo-cache-status
Cache Hit
eo-log-uuid
12346589396369794379
etag
"4657a33541bfefc991b419760ca70f9a"
last-modified
Tue, 09 Jun 2026 18:54:31 GMT
server
edgeone-pages
x-nws-log-uuid
12346589396369794379
GET
H2
200
jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/
84 KB
30 KB
25ms
6ms
Script
text/javascript
2404:6800:4003:c05::5f
Google LLC
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: extra-cyan-zfxl6ma9.edgeone.app
URL: https://extra-cyan-zfxl6ma9.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:4003:c05::5f Singapore, Singapore, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://extra-cyan-zfxl6ma9.edgeone.app/

Response headers

content-encoding
gzip
age
538794
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Sat, 05 Jun 2027 06:54:20 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 05 Jun 2026 06:54:20 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
GET
H2
200
jquery-3.1.1.min.js Show response
code.jquery.com/
85 KB
30 KB
22ms
4ms
Script
application/javascript
2a04:4e42:200::411
Fastly
General
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: extra-cyan-zfxl6ma9.edgeone.app
URL: https://extra-cyan-zfxl6ma9.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::411 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://extra-cyan-zfxl6ma9.edgeone.app/

Response headers

content-encoding
gzip
etag
W/"28feccc0-152b5"
age
2009818
x-cache
HIT, HIT
date
Thu, 11 Jun 2026 12:34:14 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
1385, 1904
x-served-by
cache-lga21947-LGA, cache-sin-wsat1880045-SIN
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1781181254.108783,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30070
server
nginx
GET
H2
200
jquery-3.3.1.js Show response
code.jquery.com/
265 KB
79 KB
20ms
2ms
Script
application/javascript
2a04:4e42:200::411
Fastly
General
Full URL
https://code.jquery.com/jquery-3.3.1.js
Requested by
Host: extra-cyan-zfxl6ma9.edgeone.app
URL: https://extra-cyan-zfxl6ma9.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::411 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin
https://extra-cyan-zfxl6ma9.edgeone.app
Referer
https://extra-cyan-zfxl6ma9.edgeone.app/

Response headers

content-encoding
gzip
etag
W/"28feccc0-42587"
age
597063
x-cache
HIT, HIT
date
Thu, 11 Jun 2026 12:34:14 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
4562, 664
x-served-by
cache-lga21980-LGA, cache-sin-wsap440089-SIN
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1781181254.108965,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
80268
server
nginx
GET
H3
200
popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/
19 KB
7 KB
32ms
20ms
Script
application/javascript
104.17.25.14
Cloudflare
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: extra-cyan-zfxl6ma9.edgeone.app
URL: https://extra-cyan-zfxl6ma9.edgeone.app/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Origin
https://extra-cyan-zfxl6ma9.edgeone.app
Referer
https://extra-cyan-zfxl6ma9.edgeone.app/

Response headers

cf-cdnjs-via
cfworker/r2
content-encoding
br
cf-cache-status
HIT
age
140283
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=udpX1LwkrKAeZIPStSwael6rNNsEOosikdXVfXujaWlzB9UUlgoFKfKTSjdmuTj0tISzBEoHtzSrrs%2BlzRttW7tIegIeMQ0Vc47kY7NT0J7K%2BnMd1mjGENcN4e2oNs9vgustoTnG"}]}
x-content-type-options
nosniff
expires
Tue, 01 Jun 2027 12:34:14 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-cdnjs-cache
HIT
date
Thu, 11 Jun 2026 12:34:14 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
priority
u=1,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
a0a0a6162fc08209-SIN
access-control-allow-origin
*
server
cloudflare
GET

undefined
logo.clearbit.com/
0
0


GET
H2
200
undefined
image.thum.io/get/width/1200/https://
21 KB
21 KB
789ms
276ms
Image
image/png
3.222.219.55
Amazon.com
General
Full URL
https://image.thum.io/get/width/1200/https://undefined
Requested by
Host: extra-cyan-zfxl6ma9.edgeone.app
URL: https://extra-cyan-zfxl6ma9.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.222.219.55 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-222-219-55.compute-1.amazonaws.com
Software
/
Resource Hash
380fe5ddf551686fd1a4e88218b04d64a56982b5b1d5e3f0f1cb087d5c3ff1bd

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://extra-cyan-zfxl6ma9.edgeone.app/

Response headers

expires
Fri, 12 Jun 2026 12:34:14 GMT
access-control-allow-origin
*
cache-control
max-age=86400
date
Thu, 11 Jun 2026 12:34:14 GMT
content-type
image/png
thum_status_code
0
content-disposition
inline; filename= "undefined.png"
GET
H2
200
json Show response
ipinfo.io/
258 B
319 B
232ms
219ms
Fetch
application/json
34.117.59.81
Google LLC
General
Full URL
https://ipinfo.io/json
Requested by
Host: extra-cyan-zfxl6ma9.edgeone.app
URL: https://extra-cyan-zfxl6ma9.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
81.59.117.34.bc.googleusercontent.com
Software
/
Resource Hash
a0410018d4d67154a6df2a118aaf80bf0815cbbf51f03a178a46e164ca6fc528

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://extra-cyan-zfxl6ma9.edgeone.app/

Response headers

via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
date
Thu, 11 Jun 2026 12:34:15 GMT
content-type
application/json
vary
accept-encoding
GET
H2
404
favicon.ico
extra-cyan-zfxl6ma9.edgeone.app/
4 KB
1 KB
64ms
63ms
Other
text/html
43.168.176.154
ACE
General
Full URL
https://extra-cyan-zfxl6ma9.edgeone.app/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.168.176.154 , Singapore, ASN139341 (ACE-AS-AP - ACE, SG),
Reverse DNS
Software
edgeone-pages /
Resource Hash
00d28cc4359700e1336124d1506eacdd693eb2b196c94bbd4de4d86ed0becd9f

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://extra-cyan-zfxl6ma9.edgeone.app/

Response headers

eo-cache-status
Cache Miss
cache-control
public,max-age=0,must-revalidate
x-nws-log-uuid
11188468953211097046
content-encoding
br
etag
"0445e4fdf1e737913bb718eca592a661"
age
0
eo-log-uuid
11188468953211097046
accept-ranges
bytes
date
Thu, 11 Jun 2026 12:34:15 GMT
content-type
text/html
last-modified
Tue, 23 Sep 2025 09:32:20 GMT
server
edgeone-pages

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
logo.clearbit.com
URL
https://logo.clearbit.com/undefined

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

3 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Popper

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
network error URL: https://logo.clearbit.com/undefined
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
recommendation verbose URL: https://extra-cyan-zfxl6ma9.edgeone.app/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://extra-cyan-zfxl6ma9.edgeone.app/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()