Phishing detection: onedrive-yhdtddn.myftp.org

Microsoft
https://onedrive-yhdtddn.myftp.org Access site
Screenshot
Screenshot of onedrive-yhdtddn.myftp.org
Investigate
Domain onedrive-yhdtddn.myftp.org1 CT host on apex
urlscan page.domain VirusTotal Whois
IP 87.229.34.97
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://onedrive-yhdtddn.myftp.org
urlscan Wayback archive.today
Cert Let's Encrypt
crt.sh Censys Google CT
Phishunt analysis Beta
30 low suspicionheuristic risk score · not a probability
Keyword matchurlscan.ioCountry mismatch
19 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates Microsoft OneDrive to harvest credentials. Registered under a No-IP dynamic DNS hostname at myftp.org, resolving to a Bulgarian server at SERVA ONE LTD on ASN 209260. Cluster membership and urlscan flagging indicate an active multi-domain campaign.

urlscan.ioKeyword matchSite cluster
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-24 · confidence 76%
Domain & Network
Whois
Registrar No-IP Technologies, LLC
Network
IP 87.229.34.97
Country BulgariaBulgaria
Hosting SERVA ONE LTD
ASN AS209260
TLS Cert Let's Encrypt
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed
Report this phishing
Brand owner Microsoft
phish@office365.microsoft.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-24 01:07 UTC  ·  Last refreshed 2026-07-24 01:30 UTC