https://0nedrive.space/

Impersonating Microsoft OneDrive

Intent: Credential collection

• Domain is not operated by Microsoft OneDrive
• Domain name closely resembles Microsoft OneDrive's real domain
• TLS certificate has no organization information
• Domain was registered very recently
• Domain not registered through Microsoft OneDrive's usual registrar

French shared-file login page asking for email and password to access shared files