dr[.]msonedrive-cdn[.]site

PhishDestroy has issued a safety advisory for dr.msonedrive-cdn.site due to active credential theft operations masquerading as Microsoft OneDrive. Current risk assessment places this domain at "under_investigation," with indicators pointing to a live phishing campaign targeting enterprise cloud users. This threat is not speculative—it is an active, evolving campaign with clear hallmarks of opportunistic credential harvesting against unsuspecting victims.

This domain was flagged by PhishDestroy’s behavioral analytics engine, revealing its role in a Microsoft OneDrive credential phishing operation. Technical indicators include registration through NAMECHEAP INC on March 26, 2026, resolution to IP 188.114.97.3, and the presence of a valid Let’s Encrypt SSL certificate. Notably, VirusTotal currently shows 1/95 security vendors detecting this domain, highlighting its novelty and the risk of evasion against traditional detection systems. Additionally, this domain has not yet been added to public blocklists, underscoring the need for proactive threat hunting.

Mitigation requires immediate action from SOC teams and end users. For organizations, block both the domain and associated IP 188.114.97.3 at the firewall and DNS layers. Monitor outbound traffic for connections to this endpoint, especially from internal systems accessing cloud services. End users should be alerted to avoid clicking links purporting to be OneDrive documents, particularly those delivered via unsolicited email or chat messages. Enable multi-factor authentication (MFA) on all cloud accounts as an additional layer of defense. PhishDestroy recommends treating any interaction with this domain as a potential security incident and conducting a forensic review of affected systems. Given the low detection rate on VirusTotal, assume compromise until proven otherwise.