onedrive.at-us.therelayservice.com

Microsoft

https://onedrive.at-us.therelayservice.com/matpwp#/main?type=onedrive&locale=en&token=klb1x-bsfowhfwldwy5w5kex8sqynzrdesvfmnxmjl0tdf7uku8us441ssdv8qxwab7r07sx8d2tcaaxbilw7jrzwi1bt5g3m5qzpqncstyknfwj-yqfe_r7n9a3fu-ucws29093snwgphbneuqsxk8mdo1puqplqq_lyyy-z2vqt0erqcmg8tcawlfl4sskggccbqduptoyfosujteijqvlgjpzlcwk0wzrnqxxdxcdnwju5qyv2u4bj3idzgs8v6qa5yn4seek0heypiiacbhbz-jsqmkneijig233aier9rnsfanl5bt7eowf4952rktiz7odbtltsmxsfazcm3ga1xvespeobe4utzckdaigmdsculmol47bkalfeo3zqnkpb9hw-0acrojr0rpyclysnuwlrdsj3cwj5fljekfatvnxgqf6t6guofe50es9j4ljrt51cmwecxfrx7gnrdtg4vqsf_loqemh0n9qs_6pgwf78nhmzq2uzw-h3syvcvq9ymx-socacp8xhredrbz2z64w4xkxwty3fqjcnrfittqfgpdtnzmyg77ykywog3xcnqzclem2_oylu4f8ynj210a8hcdlwhk_kfpo-l-rvhhjwr8rvlblvvkztoo5nswd6zvqyiyh6c14wlbgmps9-4hbixryj-niycq2ngj7cha9mbmdeuln-4mx3i54 Access site

Screenshot

Investigate

Domain onedrive.at-us.therelayservice.com0 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 170.10.128.9

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://onedrive.at-us.therelayservice.com/matpwp#/main?typ…

urlscan

Wayback

archive.today

Cert DigiCert Global G2 TLS RSA SHA256 2020 CA1

crt.sh

Censys

Google CT

Phishunt analysis Beta

19 noiseheuristic risk score · not a probability

Keyword matchLong domainBrand impersonation in path

15 signals fired · detector v2.0.0

AI analysis AIBeta

Credential harvesting

OneDrive phishing page hosted on a relay service domain with 'onedrive' in the subdomain. The URL contains a long authentication token consistent with credential interception. Brand appears off-host. Confirmed malicious by OpenPhish and urlscan.

OpenPhishurlscan.ioBrand impersonation in path

AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 62%

Domain & Network

Whois

Registrar MarkMonitor Inc.

Network

IP 170.10.128.9

Country