geode-jaguar-5366[.]typedream[.]app

This domain, geode-jaguar-5366.typedream.app, was observed hosting a brand‑impersonation page that mimics OneDrive, as indicated by the page title “OneDrive”. The site is currently offline and returns HTTP 403, which prevents content retrieval but confirms the host is still reachable. Infrastructure analysis shows the domain resolves to IP 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. Registration was performed through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 label, suggesting use of Google’s managed PKI. The server stack reports Node.js, React, Next.js, Google Cloud services (Trace and CDN), Cloudflare, and Webpack, a typical combination for modern web applications and consistent with many phishing kits.

VirusTotal scans flagged the domain in 16 of 95 engines, and the domain appears on a single blocklist operated by PhishDestroy. No additional blocklists or safe‑browsing detections were reported. The lack of nameserver information (NS_NOT_FOUND) limits deeper DNS‑level attribution. The limited detection footprint—one blocklist entry and modest vendor consensus—means the site may have been short‑lived or quickly taken down.

Defenders should continue to monitor the IP 188.114.96.3 for related activity, enforce existing blocklist entries, and consider adding the domain to internal deny lists. Because the domain leverages reputable cloud infrastructure, threat actors can rapidly spin up similar impersonation pages; therefore, security controls that inspect outbound requests for OneDrive‑related URLs remain advisable. Analysts should also track future registrations under the typedream.app sub‑domain space, as the pattern of using typedream.app for brand‑impersonation has been observed elsewhere. Until the site is permanently removed, the elevated risk rating reflects the confirmed brand impersonation and the presence of multiple detection sources.