extra-cyan-zfxl6ma9.edgeone.app
43.168.176.154
Malicious Activity!
Public Scan
Open in
urlscan Pro
https://extra-cyan-zfxl6ma9.edgeone.app/ 1mo old
Submission Tags: @phish_report
Submission: On June 11 via api (June 11th 2026, 12:34:13 pm UTC) from FI — Scanned from SG
Summary
TLS certificate: Issued by DigiCert Secure Site OV G2 TLS CN RSA... on November 17th 2025. Valid for: 1yr.
This is the only time extra-cyan-zfxl6ma9.edgeone.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 43.168.176.154 43.168.176.154 | 139341 (ACE-AS-AP) (ACE-AS-AP - ACE) | |
| 1 | 2404:6800:400... 2404:6800:4003:c05::5f | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 2 | 2a04:4e42:200... 2a04:4e42:200::411 | 54113 (FASTLY) (FASTLY - Fastly) | |
| 1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 1 | 3.222.219.55 3.222.219.55 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
| 1 | 34.117.59.81 34.117.59.81 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC) | |
| 9 | 7 |
ASN139341 (ACE-AS-AP - ACE, SG)
| extra-cyan-zfxl6ma9.edgeone.app 1mo old |
ASN15169 (GOOGLE - Google LLC, US)
| ajax.googleapis.com 10yr old |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| cdnjs.cloudflare.com 13yr old |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-222-219-55.compute-1.amazonaws.com
| image.thum.io 7yr old |
ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 81.59.117.34.bc.googleusercontent.com
| ipinfo.io 13yr old |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 784 13yr old |
108 KB |
| 2 |
edgeone.app
extra-cyan-zfxl6ma9.edgeone.app 1mo old |
5 KB |
| 1 |
ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 3845 13yr old |
319 B |
| 1 |
thum.io
image.thum.io — Cisco Umbrella Rank: 434220 7yr old |
21 KB |
| 1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 262 13yr old |
7 KB |
| 1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 571 10yr old |
30 KB |
| 0 |
clearbit.com
Failed
logo.clearbit.com Failed 9yr old |
|
| 9 | 7 |
| Domain | Requested by | |
|---|---|---|
| 2 | code.jquery.com |
extra-cyan-zfxl6ma9.edgeone.app
|
| 2 | extra-cyan-zfxl6ma9.edgeone.app | |
| 1 | ipinfo.io |
extra-cyan-zfxl6ma9.edgeone.app
|
| 1 | image.thum.io |
extra-cyan-zfxl6ma9.edgeone.app
|
| 1 | cdnjs.cloudflare.com |
extra-cyan-zfxl6ma9.edgeone.app
|
| 1 | ajax.googleapis.com |
extra-cyan-zfxl6ma9.edgeone.app
|
| 0 | logo.clearbit.com Failed |
extra-cyan-zfxl6ma9.edgeone.app
|
| 9 | 7 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.edgeone.app DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1 |
2025-11-17 - 2026-11-16 |
1yr | crt.sh |
| upload.video.google.com WR2 |
2026-05-18 - 2026-08-10 |
3mo | crt.sh |
| *.jquery.com Sectigo Public Server Authentication CA DV E36 |
2026-05-20 - 2026-12-04 |
7mo | crt.sh |
| cdnjs.cloudflare.com WE1 |
2026-05-12 - 2026-08-10 |
3mo | crt.sh |
| thum.io Amazon RSA 2048 M04 |
2026-06-05 - 2026-12-19 |
7mo | crt.sh |
| ipinfo.io R12 |
2026-05-03 - 2026-08-01 |
3mo | crt.sh |
This page contains 1 frames:
Primary Page:
https://extra-cyan-zfxl6ma9.edgeone.app/
Frame ID: 1076E187F6BA4385402346A98A1750E7
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Web MailDetected technologies
Detected patterns
- cdnjs\.cloudflare\.com
Detected patterns
- ajax\.googleapis\.com/ajax/libs/
Detected patterns
- ipinfo\.io/
Detected patterns
- jquery
- /(\d+\.\d+\.\d+)/jquery(?!\.popupoverlay\.js|(?:\.[\w-]*)*fancybox)[/.-][^u]
- /jquery(?:-(\d+\.\d+\.\d+))[/.-]
Detected patterns
- code\.jquery\.com/
Detected patterns
- /popper(?:\.min)?\.js(?:/([0-9.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
0 data transactions
| Method Protocol |
Status | Resource Path |
Size x-fer |
Time Latency |
Type MIME-Type |
IP Location |
|||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
200 |
Primary Request
/
Show response
extra-cyan-zfxl6ma9.edgeone.app/ |
13 KB 4 KB |
429ms
19ms |
Document
text/html |
43.168.176.154 ACE |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
200 |
jquery.min.js
Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
25ms
6ms |
Script
text/javascript |
2404:6800:4003:c05::5f Google LLC |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
200 |
jquery-3.1.1.min.js
Show response
code.jquery.com/ |
85 KB 30 KB |
22ms
4ms |
Script
application/javascript |
2a04:4e42:200::411 Fastly |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
200 |
jquery-3.3.1.js
Show response
code.jquery.com/ |
265 KB 79 KB |
20ms
2ms |
Script
application/javascript |
2a04:4e42:200::411 Fastly |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
200 |
popper.min.js
Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
32ms
20ms |
Script
application/javascript |
104.17.25.14 Cloudflare |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
|
undefined
logo.clearbit.com/ |
0 0 |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
200 |
undefined
image.thum.io/get/width/1200/https:// |
21 KB 21 KB |
789ms
276ms |
Image
image/png |
3.222.219.55 Amazon.com |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
200 |
json
Show response
ipinfo.io/ |
258 B 319 B |
232ms
219ms |
Fetch
application/json |
34.117.59.81 Google LLC |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
404 |
favicon.ico
extra-cyan-zfxl6ma9.edgeone.app/ |
4 KB 1 KB |
64ms
63ms |
Other
text/html |
43.168.176.154 ACE |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- logo.clearbit.com
- URL
- https://logo.clearbit.com/undefined
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)3 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Popper0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
extra-cyan-zfxl6ma9.edgeone.app
image.thum.io
ipinfo.io
logo.clearbit.com
logo.clearbit.com
104.17.25.14
2404:6800:4003:c05::5f
2a04:4e42:200::411
3.222.219.55
34.117.59.81
43.168.176.154
00d28cc4359700e1336124d1506eacdd693eb2b196c94bbd4de4d86ed0becd9f
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
380fe5ddf551686fd1a4e88218b04d64a56982b5b1d5e3f0f1cb087d5c3ff1bd
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
a0410018d4d67154a6df2a118aaf80bf0815cbbf51f03a178a46e164ca6fc528
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
eb2bddec8290192e727d70f1180abfbf213f38e7f8ee35618ab2c5f363893bbf