login[.]onemilliondrive[.]com

This domain is flagged for credential phishing, specifically targeting users of cloud storage services with fake login portals. The risk level is classified as elevated due to its active impersonation of legitimate authentication interfaces, designed to harvest usernames, passwords, and potentially multi-factor authentication codes. Analysis indicates the domain was created recently, increasing suspicion of malicious intent given its short lifespan and immediate use in phishing campaigns. Infrastructure analysis reveals the domain login.onemilliondrive.com was registered on March 25, 2026, through Amazon Registrar, Inc. It resolves to the IP address 34.253.99.190, hosted on an AWS EC2 instance in the eu-west-1 region (Ireland). At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on two security blocklists: PhishDestroy and PhishingDB. Its current status is offline, though this does not preclude future reactivation or reuse of associated infrastructure. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (34.253.99.190) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing the domain or its subdomains. Endpoint protection should be configured to detect and prevent access to known phishing URLs, particularly those mimicking cloud storage login pages. Security teams are advised to monitor for credential reuse attempts, as harvested credentials may be leveraged in follow-on attacks. User awareness training should emphasize the risks of entering credentials on unfamiliar login portals, even if they appear visually identical to legitimate services. Log analysis should focus on authentication attempts originating from the domain's IP or associated infrastructure to identify potential compromise.