# Phishing sites impersonating Onedrive PhishDestroy has recorded 18 phishing domains impersonating Onedrive since 2025-11-07, 1 of them in the last 30 days. The most used registrars are CSC Corporate Domains and Cloudflare; the most common TLDs are .link and .app. Open Onedrive only from its official app or a saved bookmark. 18Domains, all time 1Last 30 days 12Online at last check 5Confirmed takedowns ## New domains in the last 90 days Onedrive phishing domains detected per day: 5 from 2026-07-25 to 2026-10-22; peak 1. ## How to tell a fake Onedrive site Words most often added to the brand in reported domains: dweb, bafybeie, ozesxlg, liilufkica, irdmqbw, bsnyt, cneetrq, wnla, urd, blueboatpresidoo. - Type the address yourself or use a bookmark; phishing links for Onedrive arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Onedrive does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Onedrive phishing domains The 18 most recently detected domains impersonating Onedrive Domain | First detected | Status at last check | Registrar | [alternativapublicidad.mx](https://phishdestroy.io/domain/alternativapublicidad.mx/) | 2026-09-25 | Online | GoDaddy.com | [smmrgv.vercel.app](https://phishdestroy.io/domain/smmrgv.vercel.app/) | 2026-09-17 | Online | Vercel | [daemontools.org](https://phishdestroy.io/domain/daemontools.org/) | 2026-08-12 | Online | Spaceship | [theearldavis.com](https://phishdestroy.io/domain/theearldavis.com/) | 2026-07-28 | Online | GoDaddy.com | [vam-sa.pt](https://phishdestroy.io/domain/vam-sa.pt/) | 2026-07-25 | Online | — | [diegomarthin.com.br](https://phishdestroy.io/domain/diegomarthin.com.br/) | 2026-07-18 | Online | — | [lb.frdzqh6.club](https://phishdestroy.io/domain/lb.frdzqh6.club/) | 2026-07-16 | Online | Sav.com | [document-pdf-001files.vfmfb.online](https://phishdestroy.io/domain/document-pdf-001files.vfmfb.online/) | 2026-06-29 | Offline | OwnRegistrar | [grupocaceres.mx](https://phishdestroy.io/domain/grupocaceres.mx/) | 2026-06-15 | Online | NEUBOX Internet de CV | [bafybeigys74llssoyzme5yywtjsjhlqew3sksohbzsne6ouewercf7vu6a.ipfs.dweb.link](https://phishdestroy.io/domain/bafybeigys74llssoyzme5yywtjsjhlqew3sksohbzsne6ouewercf7vu6a.ipfs.dweb.link/) | 2026-05-02 | Taken down | CSC Corporate Domains | [ovv.pap.temporary.site](https://phishdestroy.io/domain/ovv.pap.temporary.site/) | 2026-04-08 | Online | eNom | [stjohnsparish.uk](https://phishdestroy.io/domain/stjohnsparish.uk/) | 2026-03-11 | Offline | NameCheap | [credopass.online](https://phishdestroy.io/domain/credopass.online/) | 2026-02-26 | Offline | NameSilo | [taslyizawellnessherbs.my](https://phishdestroy.io/domain/taslyizawellnessherbs.my/) | 2026-02-26 | Taken down | SKSA Technology Sdn Bhd | [geode-jaguar-5366.typedream.app](https://phishdestroy.io/domain/geode-jaguar-5366.typedream.app/) | 2025-12-09 | Taken down | Cloudflare | [blueboatpresidoo2.pages.dev](https://phishdestroy.io/domain/blueboatpresidoo2.pages.dev/) | 2025-12-02 | Taken down | Cloudflare | [d0wnla0dy0urd0c.help](https://phishdestroy.io/domain/d0wnla0dy0urd0c.help/) | 2025-11-20 | Offline | Porkbun | [bafybeie6jt5ozesxlg26liilufkica2irdmqbw7tk73p5bsnyt4cneetrq.ipfs.dweb.link](https://phishdestroy.io/domain/bafybeie6jt5ozesxlg26liilufkica2irdmqbw7tk73p5bsnyt4cneetrq.ipfs.dweb.link/) | 2025-11-07 | Taken down | CSC Corporate Domains | [All 18 Onedrive reports](https://phishdestroy.io/domain/?brand=Onedrive) ## Where they are registered and hosted ### Registrars - CSC Corporate Domains2 - Cloudflare2 - [Porkbun](https://phishdestroy.io/registrar/porkbun/)1 - SKSA Technology Sdn Bhd1 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)1 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)1 - [eNom](https://phishdestroy.io/registrar/enom/)1 - NEUBOX Internet de CV1 ### Top-level domains - [.link](https://phishdestroy.io/tld/link/)2 - [.app](https://phishdestroy.io/tld/app/)2 - [.online](https://phishdestroy.io/tld/online/)2 - [.mx](https://phishdestroy.io/tld/mx/)2 - [.help](https://phishdestroy.io/tld/help/)1 - [.dev](https://phishdestroy.io/tld/dev/)1 - [.my](https://phishdestroy.io/tld/my/)1 - [.uk](https://phishdestroy.io/tld/uk/)1 ### Hosting networks - Oracle Corporation3 - CLOUDFLARENET, US2 - Amazon.com, Inc.2 - PROTOCOL, US1 - Google LLC1 - SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY1 - ALIBABA-CN-NET Alibaba US Technology Co., Ltd., 1 - Namecheap, Inc.1 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Onedrive; share of all PhishDestroy reports: 0.01%. Canonical: https://phishdestroy.io/brand/onedrive/