sore-indigo-cf1xx4cwja.edgeone.app
43.174.247.29  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
URL:
https://sore-indigo-cf1xx4cwja.edgeone.app/ 2mo old
Submission: On July 20 via api (July 20th 2026, 6:09:30 am UTC) from BR — Scanned from SG
Summary HTTP 7 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 7 HTTP transactions. The main IP is 43.174.247.29, located in Singapore and belongs to ACE-AS-AP - ACE, SG. The main domain is sore-indigo-cf1xx4cwja.edgeone.app. 2mo old
TLS certificate: Issued by DigiCert Secure Site OV G2 TLS CN RSA... on November 17th 2025. Valid for: 1yr.
This is the only time sore-indigo-cf1xx4cwja.edgeone.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 43.174.247.29 43.174.247.29 139341 (ACE-AS-AP) (ACE-AS-AP - ACE)
2 2404:6800:400... 2404:6800:4003:c00::5f 15169 (GOOGLE) (GOOGLE - Google LLC)
2 142.251.10.94 142.251.10.94 15169 (GOOGLE) (GOOGLE - Google LLC)
1 104.26.13.205 104.26.13.205 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7 4
Apex Domain
Subdomains		 Transfer
2 gstatic.com
fonts.gstatic.com — Cisco Umbrella Rank: 43 10yr old
168 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 66 10yr old
3 KB
2 edgeone.app
sore-indigo-cf1xx4cwja.edgeone.app 2mo old
10 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 1460 12yr old
276 B
7 4
Domain Requested by
2 fonts.gstatic.com fonts.googleapis.com
2 fonts.googleapis.com sore-indigo-cf1xx4cwja.edgeone.app
2 sore-indigo-cf1xx4cwja.edgeone.app
1 api.ipify.org sore-indigo-cf1xx4cwja.edgeone.app
7 4

This site contains no links.

Subject Issuer Validity Valid
*.edgeone.app
DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1		 2025-11-17 -
2026-11-16		 1yr crt.sh
upload.video.google.com
WR2		 2026-06-29 -
2026-09-21		 3mo crt.sh
*.gstatic.com
WR2		 2026-06-29 -
2026-09-21		 3mo crt.sh
ipify.org
WE1		 2026-06-28 -
2026-09-26		 3mo crt.sh

This page contains 1 frames:

Primary Page: https://sore-indigo-cf1xx4cwja.edgeone.app/
Frame ID: B08E48BE2A9D80D0B3EC8904E37E6570
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Account Verification

Detected technologies

(Geolocation)
Overall confidence: 100%
Detected patterns
  • \.ipify\.org

Page Statistics

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

180 kB
Transfer

226 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H/1.1 		200
OK 		Primary Request / Show response
sore-indigo-cf1xx4cwja.edgeone.app/ 		18 KB
5 KB 		314ms
287ms 		Document
text/html		 43.174.247.29
ACE
General
Check archive.org
Download Go to
Full URL
https://sore-indigo-cf1xx4cwja.edgeone.app/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
43.174.247.29 , Singapore, ASN139341 (ACE-AS-AP - ACE, SG),
Reverse DNS
Software
edgeone-pages /
Resource Hash
a0d18ca93daef41e9f55d955b15d5f1bf5d56810c939c47ae954fbf51b0f9475

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Accept-Ranges
bytes
Age
801633
Cache-Control
public,max-age=0,must-revalidate
Connection
keep-alive
Content-Encoding
br
Content-Length
4623
Content-Type
text/html
Date
Mon, 20 Jul 2026 06:09:30 GMT
EO-Cache-Status
Cache Hit
EO-LOG-UUID
12703985521197443327
Etag
"38f2916977317464e98ea1cd50319873"
Last-Modified
Thu, 21 May 2026 23:23:24 GMT
Server
edgeone-pages
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
X-NWS-LOG-UUID
12703985521197443327
GET
H2 		200
 css2
fonts.googleapis.com/ 		22 KB
2 KB 		19ms
5ms 		Stylesheet
text/css		 2404:6800:4003:c00::5f
Google LLC
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap
Requested by
Host: sore-indigo-cf1xx4cwja.edgeone.app
URL: https://sore-indigo-cf1xx4cwja.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:4003:c00::5f Singapore, Singapore, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
2d09d5a02335bea6714b8a21156de9506fdd34d43d597aea05792ff050a588a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sore-indigo-cf1xx4cwja.edgeone.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 20 Jul 2026 06:09:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 20 Jul 2026 06:09:31 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 20 Jul 2026 04:33:08 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2 		200
 icon
fonts.googleapis.com/ 		569 B
440 B 		20ms
7ms 		Stylesheet
text/css		 2404:6800:4003:c00::5f
Google LLC
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/icon?family=Material+Icons
Requested by
Host: sore-indigo-cf1xx4cwja.edgeone.app
URL: https://sore-indigo-cf1xx4cwja.edgeone.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:4003:c00::5f Singapore, Singapore, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e8c6cdaa1c533d3f67707d78451c5ed9541f77c70a8fc79b0ca6f235263bef7c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sore-indigo-cf1xx4cwja.edgeone.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 20 Jul 2026 06:09:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 20 Jul 2026 06:09:31 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 20 Jul 2026 06:09:31 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3 		200
 KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v51/ 		42 KB
42 KB 		16ms
7ms 		Font
font/woff2		 142.251.10.94
Google LLC
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.10.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
sd-in-f94.1e100.net
Software
sffe /
Resource Hash
1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://sore-indigo-cf1xx4cwja.edgeone.app
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
164997
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 18 Jul 2027 08:19:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 18 Jul 2026 08:19:34 GMT
last-modified
Wed, 18 Feb 2026 19:51:37 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
43136
x-xss-protection
0
server
sffe
GET
H/1.1 		200
OK 		/ Show response
api.ipify.org/ 		22 B
276 B 		264ms
243ms 		Fetch
application/json		 104.26.13.205
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: sore-indigo-cf1xx4cwja.edgeone.app
URL: https://sore-indigo-cf1xx4cwja.edgeone.app/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.205 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d16a211e52eac1e7264f3201e7fd7d883a0bdc60ef4003b1159492a453412c4

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sore-indigo-cf1xx4cwja.edgeone.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
DYNAMIC
Connection
keep-alive
CF-RAY
a1dfcc295ccffe15-SIN
Access-Control-Allow-Origin
*
Content-Length
22
Date
Mon, 20 Jul 2026 06:09:31 GMT
Content-Type
application/json
Vary
Origin
Server
cloudflare
GET
H3 		200
 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v145/ 		125 KB
125 KB 		7ms
7ms 		Font
font/woff2		 142.251.10.94
Google LLC
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/materialicons/v145/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/icon?family=Material+Icons
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.10.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
sd-in-f94.1e100.net
Software
sffe /
Resource Hash
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://sore-indigo-cf1xx4cwja.edgeone.app
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
283690
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 16 Jul 2027 23:21:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 16 Jul 2026 23:21:21 GMT
last-modified
Wed, 17 Sep 2025 16:29:55 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
128352
x-xss-protection
0
server
sffe
GET
H/1.1 		200
OK 		favicon.ico
sore-indigo-cf1xx4cwja.edgeone.app/ 		18 KB
5 KB 		34ms
33ms 		Other
text/html		 43.174.247.29
ACE
General
Check archive.org
Download Go to
Full URL
https://sore-indigo-cf1xx4cwja.edgeone.app/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
43.174.247.29 , Singapore, ASN139341 (ACE-AS-AP - ACE, SG),
Reverse DNS
Software
edgeone-pages /
Resource Hash
a0d18ca93daef41e9f55d955b15d5f1bf5d56810c939c47ae954fbf51b0f9475

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sore-indigo-cf1xx4cwja.edgeone.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

EO-Cache-Status
Cache Hit
Cache-Control
public,max-age=0,must-revalidate
X-NWS-LOG-UUID
11101404418651578328
Content-Encoding
br
Etag
"38f2916977317464e98ea1cd50319873"
Age
801624
EO-LOG-UUID
11101404418651578328
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4623
Date
Mon, 20 Jul 2026 06:09:31 GMT
Last-Modified
Thu, 21 May 2026 23:23:24 GMT
Content-Type
text/html
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Server
edgeone-pages

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Generic Email (Online)

5 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 function| getEmailFromUrl function| isBase64 function| updateUrlWithEncodedEmail function| processEmail

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.