sharefile[.]transitioneast[.]com

The domain sharefile.transitioneast.com hosted a credential phishing site impersonating the Microsoft OneDrive sign-in page, as indicated by the page title "OneDrive - Sign in." This site posed a threat by attempting to capture user login credentials, specifically targeting individuals expecting a legitimate OneDrive authentication process.

Technical analysis shows the site was flagged by 16 out of 95 VirusTotal vendors, with detections from ADMINUSLabs, BitDefender, CyRadar, Ermes, and ESET. It was listed on two blocklists. The domain was registered through Hostopia Canada Corp and created on March 16, 2006. It resolved to IP address 108.167.190.178, located in the United States and assigned to AS46606 Unified Layer. The site used an SSL certificate issued by Let's Encrypt with identifier R13. Its nameservers were ns8355.hostgator.com and ns8356.hostgator.com.

The site is currently offline, reducing immediate risk. However, based on its phishing nature and detection by multiple security vendors, the overall risk level for users previously exposed is high, as credentials may have been compromised. No further active threat is present from this specific domain.