Scan report · about 1 month agoPublic

one-drive-doc.marcel-fajdiga.workers.dev

188.114.97.1AS13335 · US

Submittedhttps://one-drive-doc.marcel-fajdiga.workers.dev

Landed onhttps://one-drive-doc.marcel-fajdiga.workers.dev/

device-code phishing (Microsoft) on non-legit host

Engine tags

Verdict

1 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 19.5 s · 14 requests

01 · Visitor opensone-drive-doc.marcel-fajdiga.workers.dev

02 · Page shown

OneDrive - File Accessstyled as Microsoft · medium

03 · OutcomeToken theft — MFA includedThe code authorises the attacker's own sign-in at the real provider. Tokens are taken, not passwords.

Dangerous — confirmed threat

Automated

Its page title claims to be Microsoft, which this address is not associated with. It shows a sign-in code and sends you to the real Microsoft login page — a technique used to take over an account without ever seeing your password. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Token theftDevice-code phishing (OAuth device-grant abuse)

Entering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.

Microsoft · Microsoft device-login ref: microsoft.com/device (via response-body); on non-legit host one-drive-doc.marcel-fajdiga.workers.dev; code "BQB79SQXB"; device-code instructions present

The page shows a sign-in code and steers you to the REAL Microsoft device-login page to enter it. Doing so authorizes the attacker's own session — including your MFA — without ever asking for your password. That is why there is no login form on this page.

Analyst noteDefinitive: a device-login code + a link to the real provider on a non-legit host = device-code (device-authorization-grant) phishing. It bypasses MFA and steals tokens, not passwords. Treat as malicious; the impersonated provider is the takedown/abuse target.

InfoBrand impersonation detected

Microsoft · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 25, 2026
Redirects: 0 hops · / → /

32 malicious11 suspicious

Hashes & fingerprints

Page Hash91c1198836a216fcb9e4df257c7d23af357cf6953756bbcb7b838e3fa956812d Favicon Hashb72690846060d6a9a6f0ebe35bdf7cfde4f25fd4967151d211235f6475925343 DOM Hash9f4b490b4ffb62da5aa011c53d10f189b36d69f9c47e71c1c253f58c059229c1 Screenshot pHash8096e9ccdc737133 JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint31D3BA89C892736A07A6AE006743BF71A053CCE0 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “OneDrive - File Access” · brand shown: Microsoft (medium)

Visit Site

Engines

8 · time to verdict