oneclient.sfx.ms - URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned oneclient.sfx.ms and returned a unknown verdict (score -12). The page resolved to 23.40.52.69 on Akamai Technologies, Inc. in AU. 2 domains and 1 IP were contacted. 25 malware samples communicate with this URL (Fileinfector, Fugrafa, Changeup, Razy). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://oneclient.sfx.ms/ - Domain: oneclient.sfx.ms · IP: 23.40.52.69 · AS20940 · AU
- Server: AkamaiNetStorage
- HTTP status: 200 · text/html
- TLS issuer: C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04 · valid to Nov 15 22: · subject C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=*.sfx.ms
- Evidenced operator: Microsoft Corporation
- Scan tier: fast · observed 2026-08-21 07:57:19 UTC
Malware communicating with this URL (25)
These samples were observed contacting or being served from oneclient.sfx.ms. Each links to its full analysis.
- bd00b5b0b4ff9f6fc6c67ecfd19e3be3115cb0e53c8a45956171fcc2f39ebe3c - contacted ·
bd00b5b0b4ff9f6fc6c67ecfd19e3be3· first seen 2026-08-21 - Fileinfector - contacted ·
a120bb56775bd34337709b59a91c7a28· first seen 2026-08-20 - Fugrafa - contacted ·
3a26310944a3af4238416b3354b3c9a0· first seen 2026-08-20 - 63b5c39c8d25d7adf702d78d31ea768097967eec978db3a8f1a77d141383fd72 - contacted ·
63b5c39c8d25d7adf702d78d31ea7680· first seen 2026-08-20 - Changeup - contacted ·
0f5ba30d1e26c31bfa1f88e220fd3c91· first seen 2026-08-20 - Razy - contacted ·
2adfe76b9f0f3b3ac22cda11991c80e2· first seen 2026-08-20 - Blocker - contacted ·
9e3ae9173bff0d05bf6736a811e57eb2· first seen 2026-08-20 - RedLine - contacted ·
aa0fe406011569b72ed4ad331bad5675· first seen 2026-08-20 - 897c259105e7112911f914769acdbc0f65ac7c774bee50d656dd0b168e9e609a - contacted ·
897c259105e7112911f914769acdbc0f· first seen 2026-08-20 - Crypted - contacted ·
c270db65418c45204b151f743ef8b423· first seen 2026-08-20 - Hoax - contacted ·
e4f76bc4ad3e31479e1b529222b98e1f· first seen 2026-08-19 - Container - contacted ·
4bed700a5b40eca3c216814db619cc52· first seen 2026-08-19 - Delf - contacted ·
40fd6ccb1d3ec74773909b287b09e6ee· first seen 2026-08-19 - witumavililumaposoxu.pdf - contacted ·
4d84d6a0a2251683fdcfb9ce23fefa6e· first seen 2026-08-19 - Phishing - contacted ·
7f50fbc07015f8805df0d92211385b0d· first seen 2026-08-19
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 23.40.52.69 - AS20940 Akamai Technologies, Inc. (Australia)
Observed indicators
- oneclient.sfx.ms
- onedrive.live.com
- 23.40.52.69
- https://oneclient.sfx.ms/
- http://onedrive.live.com/
Other scans of oneclient.sfx.ms (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
Questions about oneclient.sfx.ms
- Is oneclient.sfx.ms safe?
- The scan of oneclient.sfx.ms on 21 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with oneclient.sfx.ms?
- 25 analysed samples communicate with this URL, including Fileinfector, Fugrafa, Changeup, Razy.
- How was oneclient.sfx.ms checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of oneclient.sfx.ms
Scanned on MalwareAnalyzer by Cyble · Open interactive scan