Phishing detection: wahat-ipp.sa-onedrive.com
Microsoft Screenshot
Investigate
Domain
wahat-ipp.sa-onedrive.com5 CT hosts on apex
urlscan
VirusTotal
Whois
IP
188.114.97.3
ipinfo
Greynoise
URL
https://wahat-ipp.sa-onedrive.com
Phishunt analysis Beta
30
low suspicionheuristic risk score · not a probability
Why?
- +5.3 Keyword match
- +5.1 Site cluster
- +5.1 urlscan.io
- +4.0 Young domain
- +3.4 Shared IP cluster
- +1.8 ASN reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.5 Long domain
- +0.3 Free CA
- +0.2 Hyphens
- +0.2 Suspicious TLD
- +0.1 Deep subdomain
18 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
A newly registered domain (age zero days) with 'onedrive' in its name mimics Microsoft OneDrive, probably to harvest Microsoft credentials. It is fronted by Cloudflare with minimal domain status and is flagged by urlscan.
Young domainNo registrar lockurlscan.io
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-27 · confidence 65%
Domain & Network
Whois
Registrar
Cloudflare, Inc.
Network
IP
188.114.97.3 Cloudflare CDN
Country
United States
United States
Hosting
Cloudflare, Inc.
ASN
AS13335
TLS Cert
Google Trust Services
External detection
urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed · SANS ISC
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
Microsoft
Submit to blocklists