Phishing sites impersonating Onedrive

PhishDestroy has recorded 18 phishing domains impersonating Onedrive since 2025-11-07, 1 of them in the last 30 days. The most used registrars are CSC Corporate Domains and Cloudflare; the most common TLDs are .link and .app. Open Onedrive only from its official app or a saved bookmark.

18
Domains, all time
1
Last 30 days
12
Online at last check
5
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 12026-07-26: 02026-07-27: 02026-07-28: 12026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 12026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 12026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 12026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Onedrive phishing domains detected per day: 5 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake Onedrive site

Words most often added to the brand in reported domains: dweb, bafybeie, ozesxlg, liilufkica, irdmqbw, bsnyt, cneetrq, wnla, urd, blueboatpresidoo.

  • Type the address yourself or use a bookmark; phishing links for Onedrive arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Onedrive does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Onedrive phishing domains

The 18 most recently detected domains impersonating Onedrive
DomainFirst detectedStatus at last checkRegistrar
alternativapublicidad.mx2026-09-25OnlineGoDaddy.com
smmrgv.vercel.app2026-09-17OnlineVercel
daemontools.org2026-08-12OnlineSpaceship
theearldavis.com2026-07-28OnlineGoDaddy.com
vam-sa.pt2026-07-25Online—
diegomarthin.com.br2026-07-18Online—
lb.frdzqh6.club2026-07-16OnlineSav.com
document-pdf-001files.vfmfb.online2026-06-29OfflineOwnRegistrar
grupocaceres.mx2026-06-15OnlineNEUBOX Internet de CV
bafybeigys74llssoyzme5yywtjsjhlqew3sksohbzsne6ouewercf7vu6a.ipfs.dweb.link2026-05-02Taken downCSC Corporate Domains
ovv.pap.temporary.site2026-04-08OnlineeNom
stjohnsparish.uk2026-03-11OfflineNameCheap
credopass.online2026-02-26OfflineNameSilo
taslyizawellnessherbs.my2026-02-26Taken downSKSA Technology Sdn Bhd
geode-jaguar-5366.typedream.app2025-12-09Taken downCloudflare
blueboatpresidoo2.pages.dev2025-12-02Taken downCloudflare
d0wnla0dy0urd0c.help2025-11-20OfflinePorkbun
bafybeie6jt5ozesxlg26liilufkica2irdmqbw7tk73p5bsnyt4cneetrq.ipfs.dweb.link2025-11-07Taken downCSC Corporate Domains

All 18 Onedrive reports

Where they are registered and hosted

Registrars

  1. CSC Corporate Domains2
  2. Cloudflare2
  3. Porkbun1
  4. SKSA Technology Sdn Bhd1
  5. NameSilo1
  6. NameCheap1
  7. eNom1
  8. NEUBOX Internet de CV1

Top-level domains

  1. .link2
  2. .app2
  3. .online2
  4. .mx2
  5. .help1
  6. .dev1
  7. .my1
  8. .uk1

Hosting networks

  1. Oracle Corporation3
  2. CLOUDFLARENET, US2
  3. Amazon.com, Inc.2
  4. PROTOCOL, US1
  5. Google LLC1
  6. SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY1
  7. ALIBABA-CN-NET Alibaba US Technology Co., Ltd., 1
  8. Namecheap, Inc.1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Onedrive; share of all PhishDestroy reports: 0.01%.