mydrive[.]effem[.]com

The domain mydrive.effem.com is currently active and classified as a high‑risk brand‑impersonation site targeting Microsoft. The site presents a French‑language page titled “Validation du lien de partage,” which aligns with a Google‑phishing kit designed to harvest Microsoft credentials. The risk level is marked high, and the unique seed fcf1d5 has been assigned for tracking.

Infrastructure analysis shows the domain was registered on 25 October 1994 through NOM‑IQ Ltd dba Com Laude. DNS resolution points to 13.107.137.10, an IP address owned by Microsoft Corporation in the United States, and the domain uses four Amazon Route 53 nameservers (ns‑1187.awsdns‑20.org, ns‑1824.awsdns‑36.co.uk, ns‑258.awsdns‑32.com, ns‑932.awsdns). The site delivers an HTTP 302 redirect and serves a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, indicating a valid SSL chain. Detected client‑side technologies include jQuery and HTTP Strict Transport Security (HSTS).

Reputation services flag the domain as malicious. VirusTotal reports nine out of ninety‑five scanners flagging the host, while Scamadviser assigns a trust score of 1 / 100 and Gridinsoft a score of 0 / 100. The domain appears on one public security blocklist and has been actively blocked by the PhishDestroy sinkhole. These signals corroborate the classification as a Google‑phishing operation impersonating Microsoft services.

Defenders should add mydrive.effem.com to network and email filtering blocklists, monitor DNS queries for the associated Amazon nameservers, and enforce TLS inspection to capture the redirected payload. Incident response teams should treat any credential submissions to the “Validation du lien de partage” page as compromised and initiate credential rotation for affected Microsoft accounts. Ongoing intelligence collection is advised to detect any related infrastructure that may reuse the same registration or hosting pattern.