Exchange Barrel'o'phish 5-6-20

Exchange Phishing Sites:
https://unada.ga/.well-known/pki-validation/OWA-AUT/index.html?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&#alfredhole@youare.com
https://aadarshgroup.org/owa111/?path=orly@owl.com

Sandbox run:
https://app.any.run/tasks/9ec2427c-9d7a-434f-9327-c88d014a4574
https://app.any.run/tasks/9c7f9292-2381-43b0-8f45-3855571054f6

Pivot to other sites using the same kit:
https://urlscan.io/result/5f355edb-792d-443a-812a-f33104c16b4c/related/

Potentially running off Storage on Google APIs:

#storage.googleapis.com/aoutlook-platilla-256443704/index.html
#storage.googleapis.com/owaab/index.html
#storage.googleapis.com/owa-ym/index.html

Cred validation sites:
munshiganjeralo.com

Total list of domains running this phishing kit:

annaeva.hu
blufftonbaysails.com
cna.thephotosisters.com
cressolbank.com
dma.bieca.net
futureguides.in
gunnesonflooring.com
hindiclub.in
htt.munsternissan.com
illustrateomar.net
mobile.gepf.co.za
mxi.humanitythemixtape.com
munshiganjeralo.com
neg.willstrust.info
sable-tidy-deposit.glitch.me
simptaxt-err.tk
sorobonmasters.com
speedbangla.akij.net
staging.zoelifespasalon.com
syntax-oga.us-south.cf.appdomain.cloud
virtualschooling.com
ww3.nycimmigrationevals.net
www.aislacontrol.com
www.campcrest.com
www.habibinyc.com
www.ilovingme.services
www.lightnhealthy.com.au
www.unitronsea.com