alist-od-token[.]pages[.]dev

This domain is under investigation for operating as a brand impersonation and credential harvesting site targeting Microsoft OneDrive users. The page title, OneDrive 令牌获取助手 (OneDrive Token Acquisition Assistant), indicates the site is designed to trick users into providing authentication tokens under the guise of a legitimate assistant tool. The domain was registered on April 2, 2026, via Cloudflare, Inc., and resolves to IP address 172.66.47.54 hosted by Cloudflare in Canada. It uses nameservers gracie.ns.cloudflare.com and merlin.ns.cloudflare.com, and its SSL certificate is issued by Google Trust Services. Despite a Gridinsoft trust score of 0/100 and appearance on one security blocklist, VirusTotal scans by 94 vendors show no current detections, though the absence of flags does not confirm safety. The site remains active and responds with HTTP status 200. Defenders should treat this domain as a confirmed phishing threat, block access at the network level, and investigate any user interactions for potential token compromise. The exact technical kit and full page content have not yet been analysed.