Is webmail-terms-services.edgeone.cool safe?

A password box on a hostname that is not a mail provider

The page asks the visitor to type an email address and an email password into fields on a hostname that is not a mail provider's domain, and no operator identity is shown anywhere on screen. The only interactive elements are those two fields and the "Log in" button.

The footer carries a cPanel logo with "Copyright© 2026 cPanel, L.L.C." and a Privacy Policy link, plus a row of language options. That is borrowed hosting-panel branding, not a mailbox service's own identity, and it tells a visitor nothing about who receives what they type.

The host is a subdomain of edgeone.cool, a free default-domain namespace used for temporary Tencent EdgeOne deployments. A keyword-stuffed label like "webmail-terms-services" on a throwaway free subdomain is not how a real mail provider publishes its sign-in page.

Phishing trackers and antivirus engines both point the same way

Three international security and anti-fraud organisations — Poland's national CERT, PhishDestroy and The Block List Project — have reported edgeone.cool as a phishing site used to steal account credentials. A separate tracker lists a fake "Webmail Sign-in" page on the sibling edgeone.dev namespace, and another records an edgeone.cool subdomain impersonating tech support.

Saved antivirus data records five independent engine families returning an adverse result for this host, in phishing and malware categories. That data is a saved observation rather than a fresh submission, so the timing should be treated as approximate, but the verdicts themselves are real.

A domain-reputation write-up scores edgeone.cool at 3 out of 100. The parent domain being 519 days old reflects the free hosting namespace, not the age of this particular subdomain, so it is no comfort here.

Clean encryption and a clean Google check do not make the page trustworthy

The saved TLS check found a valid encrypted connection and the browser threat feed returned no threat warning, so a browser may show no warning at all when the page loads. The hosting IP also carries an abuse confidence score of 0/100 across four saved reports.

Those results describe the connection and the address, not the intent of whoever built the page. A valid certificate only means the traffic is encrypted to this host; it says nothing about whether the password typed into the form goes to its rightful owner. The site's own contact details were not reviewed because the page text was not read in full, so no operator, company or support channel can be confirmed from the page itself.