oneclient.sfx.ms - URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned oneclient.sfx.ms and returned a unknown verdict (score -12). The page resolved to 23.40.52.211 on Akamai Technologies, Inc. in AU. 2 domains and 1 IP were contacted. 19 malware samples communicate with this URL (Blocker, RedLine, Crypted, Hoax). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://oneclient.sfx.ms/ - Domain: oneclient.sfx.ms · IP: 23.40.52.211 · AS20940 · AU
- Server: AkamaiNetStorage
- HTTP status: 200 · text/html
- TLS issuer: C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04 · valid to Nov 15 22: · subject C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=*.sfx.ms
- Evidenced operator: Microsoft Corporation
- Scan tier: fast · observed 2026-08-20 14:52:22 UTC
Malware communicating with this URL (19)
These samples were observed contacting or being served from oneclient.sfx.ms. Each links to its full analysis.
- Blocker - contacted ·
9e3ae9173bff0d05bf6736a811e57eb2· first seen 2026-08-20 - RedLine - contacted ·
aa0fe406011569b72ed4ad331bad5675· first seen 2026-08-20 - 897c259105e7112911f914769acdbc0f65ac7c774bee50d656dd0b168e9e609a - contacted ·
897c259105e7112911f914769acdbc0f· first seen 2026-08-20 - Crypted - contacted ·
c270db65418c45204b151f743ef8b423· first seen 2026-08-20 - Hoax - contacted ·
e4f76bc4ad3e31479e1b529222b98e1f· first seen 2026-08-19 - Container - contacted ·
4bed700a5b40eca3c216814db619cc52· first seen 2026-08-19 - Delf - contacted ·
40fd6ccb1d3ec74773909b287b09e6ee· first seen 2026-08-19 - witumavililumaposoxu.pdf - contacted ·
4d84d6a0a2251683fdcfb9ce23fefa6e· first seen 2026-08-19 - Phishing - contacted ·
7f50fbc07015f8805df0d92211385b0d· first seen 2026-08-19 - normal_5f8759a6dec3e.pdf - contacted ·
54b7b01e6b44511f6beb39a7d5ed46d3· first seen 2026-08-19 - Container - contacted ·
2e48b5476613b6baefe6a2b4d3e0bb51· first seen 2026-08-19 - Razy - contacted ·
246edc8803ac4d5da6267275d9e60670· first seen 2026-08-19 - Mira - contacted ·
cd73128b4256c2a16ae991f3b03506a9· first seen 2026-08-18 - Upantix - contacted ·
c153d34301f19b54200c75b7f770657f· first seen 2026-08-18 - HUILoader - contacted ·
92b7697805ed4b705eb3e8fd1c20722e· first seen 2026-08-18
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 23.40.52.211 - AS20940 Akamai Technologies, Inc. (Australia)
Observed indicators
- oneclient.sfx.ms
- onedrive.live.com
- 23.40.52.211
- https://oneclient.sfx.ms/
- http://onedrive.live.com/
Other scans of oneclient.sfx.ms (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
Questions about oneclient.sfx.ms
- Is oneclient.sfx.ms safe?
- The scan of oneclient.sfx.ms on 20 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with oneclient.sfx.ms?
- 19 analysed samples communicate with this URL, including Blocker, RedLine, Crypted, Hoax.
- How was oneclient.sfx.ms checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of oneclient.sfx.ms
Scanned on MalwareAnalyzer by Cyble · Open interactive scan