onedrivecopilot[.]sbs

PhishDestroy identifies onedrivecopilot.sbs as an active mega-cloud scam hosting a Microsoft-branded phishing landing page. The threat type is generic phishing aimed at harvesting corporate Office 365 credentials under the guise of a OneDrive Copilot upgrade prompt. Risk level is elevated because the domain masquerades as a legitimate Microsoft service and leverages a Lookaside-blocked IP to harvest live credentials, which can be weaponized within hours for account takeover and data exfiltration.

This domain was flagged by 7 of 95 VirusTotal security vendors, registered on March 30 2026 through Dynadot LLC, and resolves to IP 3.129.44.31. It obtained a Let’s Encrypt SSL certificate to appear trustworthy, and its recent creation date allows it to evade some blocklists before accumulating reputation. Unlike many generic phishing domains, this one combines a plausible lures (Copilot upgrade), fresh infrastructure (March 30 creation), and hosting on AWS (IP 3.129.44.31) to maximize dwell time and victim interaction.

Mitigation starts with DNS blocking of the domain and IP. Users encountering this page should close the browser immediately, clear cached credentials in their password manager, and enable multi-factor authentication on all Microsoft 365 accounts. Report the domain to your security team and to Microsoft via secure@microsoft.com so they can add the indicator to their phishing intelligence feeds.