blueboatpresidoo2[.]pages[.]dev

This report details a newly registered domain, blueboatpresidoo2.pages.dev, which was actively impersonating the OneDrive brand. The site presented a page titled "OneDrive" and was classified as an Impersonation (OneDrive) scam. The primary threat posed by this site was credential harvesting, as it attempted to trick users into entering their OneDrive login credentials on a fraudulent page.

Technical analysis confirms the malicious nature of the domain. VirusTotal data shows 12 out of 95 security vendors detected the site as malicious. The domain was registered on 2024-07-13 with registrar Cloudflare, Inc. and resolves to IP address 188.114.96.3, located in the United States and assigned to AS13335 Cloudflare, Inc. The site uses an SSL certificate issued by Google Trust Services / WE1. Nameservers are ara.ns.cloudflare.com and ganz.ns.cloudflare.com. The domain was flagged by security vendors including alphaMountain.ai, BitDefender, CRDF, CyRadar, and ESET, and is listed on one blocklist.

The domain is currently offline and inaccessible. GridinSoft trust rating is 0 out of 100, and the DOM risk score is 10, indicating a high-risk threat. The site's creation date and impersonation of a major brand suggest it was a short-lived, targeted phishing campaign.