onedrive-thyyhncdcv.servehttp.com

Microsoft

https://onedrive-thyyhncdcv.servehttp.com Access site

Screenshot

Investigate

Domain onedrive-thyyhncdcv.servehttp.com1 CT host on apex

urlscan

page.domain

VirusTotal

Whois

IP 87.229.34.97

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://onedrive-thyyhncdcv.servehttp.com

urlscan

Wayback

archive.today

Cert Let's Encrypt

crt.sh

Censys

Google CT

Phishunt analysis Beta

30 low suspicionheuristic risk score · not a probability

Keyword matchLong domainHigh entropy

19 signals fired · detector v2.0.0

AI analysis AIBeta

Credential harvesting

Site impersonates Microsoft OneDrive to harvest credentials. Uses a No-IP dynamic DNS hostname at servehttp.com with a long randomized subdomain, hosted on a Bulgarian server at SERVA ONE LTD. Confirmed malicious by urlscan and part of an active cluster on the same IP.

urlscan.ioKeyword matchShared IP cluster

AI-generated from stored detector signals - the AI never visited the site. · 2026-07-24 · confidence 78%

Domain & Network

Whois

Registrar No-IP Technologies, LLC

Network

IP 87.229.34.97

Country