Phishing detection: onedrive-yhlkjcc.3utilities.com

Microsoft
https://onedrive-yhlkjcc.3utilities.com Access site
Screenshot
Screenshot of onedrive-yhlkjcc.3utilities.com
Investigate
Domain onedrive-yhlkjcc.3utilities.com0 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 87.229.34.97
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://onedrive-yhlkjcc.3utilities.com
urlscan Wayback archive.today
Cert Let's Encrypt
crt.sh Censys Google CT
Phishunt analysis Beta
31 low suspicionheuristic risk score · not a probability
Keyword matchLong domainHigh entropy
20 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates Microsoft OneDrive using a randomised subdomain on a free hosting service, displaying branded content to harvest account credentials. Hosted in Bulgaria and flagged as malicious by urlscan.

Keyword matchCountry mismatchurlscan.io
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-22 · confidence 65%
Domain & Network
Whois
Registrar No-IP Technologies, LLC
Network
IP 87.229.34.97
Country BulgariaBulgaria
Hosting SERVA ONE LTD
ASN AS209260
TLS Cert Let's Encrypt
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed
Report this phishing
Brand owner Microsoft
phish@office365.microsoft.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-22 17:06 UTC  ·  Last refreshed 2026-07-24 02:45 UTC