oneclient.sfx.ms - URL scan, 19 Aug 2026
MalwareAnalyzer by Cyble scanned oneclient.sfx.ms and returned a unknown verdict (score -12). The page resolved to 23.40.52.69 on Akamai Technologies, Inc. in AU. 2 domains and 1 IP were contacted. 10 malware samples communicate with this URL (Container, Razy, Mira, Upantix). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://oneclient.sfx.ms/ - Domain: oneclient.sfx.ms · IP: 23.40.52.69 · AS20940 · AU
- Server: AkamaiNetStorage
- HTTP status: 200 · text/html
- TLS issuer: C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 RSA CA OCSP 04 · valid to Nov 15 22: · subject C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=*.sfx.ms
- Evidenced operator: Microsoft Corporation
- Scan tier: fast · observed 2026-08-19 15:15:28 UTC
Malware communicating with this URL (10)
These samples were observed contacting or being served from oneclient.sfx.ms. Each links to its full analysis.
- normal_5f8759a6dec3e.pdf - contacted ·
54b7b01e6b44511f6beb39a7d5ed46d3· first seen 2026-08-19 - Container - contacted ·
2e48b5476613b6baefe6a2b4d3e0bb51· first seen 2026-08-19 - Razy - contacted ·
246edc8803ac4d5da6267275d9e60670· first seen 2026-08-19 - Mira - contacted ·
cd73128b4256c2a16ae991f3b03506a9· first seen 2026-08-18 - Upantix - contacted ·
c153d34301f19b54200c75b7f770657f· first seen 2026-08-18 - HUILoader - contacted ·
92b7697805ed4b705eb3e8fd1c20722e· first seen 2026-08-18 - Dinwod - contacted ·
7911e6b48593378d6c9b4e2c7e573334· first seen 2026-08-18 - Upantix - contacted ·
7477b7bc28285557505e613678e6a244· first seen 2026-08-18 - main[1].css - contacted ·
d30b4ea6f68456672f5abb35e9dcf7d5· first seen 2026-08-17 - 1d110017716057b8c3496326430c368004b38d1d67e99731ff3d750690d9c122 - contacted ·
1d110017716057b8c3496326430c3680· first seen 2026-08-16
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 23.40.52.69 - AS20940 Akamai Technologies, Inc. (Australia)
Observed indicators
- oneclient.sfx.ms
- onedrive.live.com
- 23.40.52.69
- https://oneclient.sfx.ms/
- http://onedrive.live.com/
Other scans of oneclient.sfx.ms (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
Questions about oneclient.sfx.ms
- Is oneclient.sfx.ms safe?
- The scan of oneclient.sfx.ms on 19 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with oneclient.sfx.ms?
- 10 analysed samples communicate with this URL, including Container, Razy, Mira, Upantix.
- How was oneclient.sfx.ms checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of oneclient.sfx.ms
Scanned on MalwareAnalyzer by Cyble · Open interactive scan