Security Scan: OneDrive

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3175a85b-b39b-4c6b-aa30-d38555a359bc Domain and IP registration (RDAP)/api/v1/rdap/3175a85b-b39b-4c6b-aa30-d38555a359bcHow often this domain was scanned/api/v1/domain/stats/tudor.ind.br Scan history for this domain/api/v1/domain/history/tudor.ind.br?limit=15

This website contacted 7 IPs in 2 countries across 5 domains to perform 12 HTTP transactions. The main domain is tudor.ind.br and was registered 26 years ago.

Submitted URL: https://tudor.ind.br/hstrfp/scur588566256.html

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Fake Microsoft OneDrive 'secure folder' share page on a hijacked Brazilian domain that tricks users into pasting an access code and signing in, while JavaScript sends device-code data to admin.greatgod.cfd. Credential phishing.

Risk Factors (6)

Impersonation of Microsoft OneDrive on an unrelated, unranked domain

Credential-capture workflow (copy/paste access code + Microsoft account sign-in) driven by JavaScript rather than a visible form, evading form-based detection

Cross-origin POST to admin.greatgod.cfd carrying a user_id/device_code parameter — credential/device-code exfiltration channel

Use of .cfd TLD backend infrastructure (high-abuse TLD) flagged by network IDS

False trust marker 'Microsoft Verified' displayed on a non-Microsoft site

Obfuscated JavaScript heuristics on a simple static share page

Domain age information unavailable

Details

Page Title

OneDrive

Scan Type

public

Domain Name Analysis

The domain name 'tudor.ind.br' uses the Brazilian country-code top-level domain (.ind.br). The second-level label 'tudor' is 5 characters long holding two vowels versus 3 consonants. Breaking it apart gives 1 word: tudor. The median word length lands at 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

E New Secure Folder Shared With You Verity your identity to access +32 MB Encnyt | shared O ony access code below O ick verity « Paste cone cr O sienna aroson account FV6F9R Copy Code E Waitin...

Page Load Overview

2.00s

Total Load Time

64 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:61%

Script:Latin

Direction:ltr

Detection Details

Text Length:295 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software37% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

37%

download file sharing

37%

documentation technical

32%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
6	143.95.215.168	Vinhedo, São Paulo, Brazil	AS31898Oracle Corporation
1	142.251.14.102	Brazil	AS31898Oracle Corporation
1	104.243.43.77	Piscataway, New Jersey, United States	AS23470ReliableSite.Net LLC
1	172.67.193.119Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	104.243.45.200	Piscataway, New Jersey, United States	AS23470ReliableSite.Net LLC
1	142.251.14.139Google · CDN	United States	AS15169Google LLC
1	104.21.73.243Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
12	7	-	-