O365 Cred Phishing links - running list

2020-05-18: O365 Cred Phishing links
=====================================
hxxps://mhm[.]gs/w-redirec/re/base64email/<user's email>  --> hxxps://e-audiomessages[.]com/e-audio/voIp/tod/9lmcr0osevuxhjzbtn2y1p54qak6wg837idf1s82gj3rymvaqzfwtxel5nho9704icd6bkpuo3cvbhr7epkxytj5zgsw0fuq6l28niam419d?data=<user's email>

hxxps://flaviodomingues[.]com/<user's email> --> Suspended

hxxps://putumayocamsa[.]com/bz/06545/<user's email> --> hxxps://adminsddee[.]neocities[.]org/#<user's email>

hxxp://ma-1[.]stullz-ats[.]com/?1=<user's email> --> hxxps://ma-1[.]sunya[.]tk/[.]mn/[.]mn/#<user's email>

2020-05-21
===========
- Note: Once again using attachments that are html files with JS encoding

https://hubbyandbees.com/o/Dee/<email address>> --https://objectstorage.us-ashburn-1.oraclecloud.com/n/idcpv4rkpzql/b/ashburneatu-sa/o/oauthcommonsentfmgrpl.html

https://sumepro.com/Dustin/<email address> --> https://tichmessages.com/office365/no@thanks.local

https://infogotherie.net/<name>/<email address> --> https://infogotherie.org/office365/no@thanks.local

ma-1.solltec.eu/.cc/.cc/?1=<email address>&#46;com --> https://saegn.tk/.gc/office365/n7rke5bl4szqiax1g0dtocyuf83wpm6vj92hy70c4lz9g6nv3swiq8hxjmdotfau12brk5pebcogt2nms4dwj93rq7l6fkzypxve0u8i1a5h?data=bm9AbG9jYWwubG9jYWw=

ma-1.inducstotherm.co.uk/.cb/.cb/?1=<email address> --> https://saegn.tk/.gc/office365/d37pijgeusz6kvc8qfm1wat4byr029loh5nxem3dxvun98o6fjzkb1lg0rq54iswph2ya7tc9cz4tgnpv2iaw1kqro0sxl5d63ju7emyfhb8?data=bm9Abm8ubG9jYWw=