onedrive-yhtcdsaa.serveblog.net

Microsoft

https://onedrive-yhtcdsaa.serveblog.net Access site

Screenshot

Investigate

Domain onedrive-yhtcdsaa.serveblog.net0 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 87.229.34.97

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://onedrive-yhtcdsaa.serveblog.net

urlscan

Wayback

archive.today

Cert Let's Encrypt

crt.sh

Censys

Google CT

Phishunt analysis Beta

30 low suspicionheuristic risk score · not a probability

Keyword matchLong domainHigh entropy

19 signals fired · detector v2.0.0

AI analysis AIBeta

Credential harvesting

Site impersonates Microsoft OneDrive to harvest credentials. Uses a No-IP dynamic DNS subdomain under serveblog.net with a randomized label, hosted on a Bulgarian server at SERVA ONE LTD. Confirmed malicious by urlscan and clustered with other OneDrive lures on the same IP.

urlscan.ioKeyword matchLong domain

AI-generated from stored detector signals - the AI never visited the site. · 2026-07-24 · confidence 78%

Domain & Network

Whois

Registrar No-IP Technologies, LLC

Network

IP 87.229.34.97

Country