O365 Phishing campaigns on Appspot

Microsoft Office 365 credential harvesting campaigns:
-> ts.r.appspot.com
-> wl.r.appspot.com
-> df.r.appspot.com
-> uc.r.appspot.com

IOCs:

Domains:
login-o365secure.ts.r.appspot.com
microsoft-o365-outlook.ts.r.appspot.com
microsoft-outlook-authenticate.ts.r.appspot.com
login-microsoft-quarantine.ts.r.appspot.com
office-outlook365-account.ts.r.appspot.com
office365-authenticate.ts.r.appspot.com
login-microsoftonline-common.ts.r.appspot.com
logln-micr0s0ft-0nline.ts.r.appspot.com

2268519-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
6843505-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
3255394-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
758468-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
9178288-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
8857954-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
6157073-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
2300884-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
8804941-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
4440011-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
4948182-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
659813-dot-n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com
6823.n-e-w-me-ss-age-po-rt-al.wl.r.appspot.com

onedrive-secure.df.r.appspot.com
login-microsoft-authent.df.r.appspot.com
owa-login-outlook-web.df.r.appspot.com

office365-parsec-280413.uc.r.appspot.com

Tracking:
https://urlscan.io/ip/2a01:111:f100:9001::1761:914f
https://urlscan.io/ip/2a01:111:f100:8000::4134:941b
https://urlscan.io/search/#domain%3Ats.r.appspot.com
https://urlscan.io/search/#domain%3Awl.r.appspot.com

IPv4
152.199.19.160
152.199.23.37
158.175.115.202