Office Phishing

>curl -v -L -A "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0" https://www.borhansys.com/wp-content/plugins/css-ready-selectors/bashredirect/dxbway/YUGP8U/Zm9vQGJhci5jb20=
*   Trying 171.22.26.31...
* TCP_NODELAY set
* Connected to www.borhansys.com (171.22.26.31) port 443 (#0)
* schannel: SSL/TLS connection with www.borhansys.com port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 182 bytes...
* schannel: sent initial handshake data: sent 182 bytes
* schannel: SSL/TLS connection with www.borhansys.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* schannel: SSL/TLS connection with www.borhansys.com port 443 (step 2/3)
* schannel: encrypted data got 4096
* schannel: encrypted data buffer: offset 4096 length 4096
* schannel: encrypted data length: 3998
* schannel: encrypted data buffer: offset 3998 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with www.borhansys.com port 443 (step 2/3)
* schannel: encrypted data got 1024
* schannel: encrypted data buffer: offset 5022 length 5022
* schannel: encrypted data length: 81
* schannel: encrypted data buffer: offset 81 length 5022
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with www.borhansys.com port 443 (step 2/3)
* schannel: encrypted data got 266
* schannel: encrypted data buffer: offset 347 length 5022
* schannel: sending next handshake data: sending 126 bytes...
* schannel: SSL/TLS connection with www.borhansys.com port 443 (step 2/3)
* schannel: encrypted data got 51
* schannel: encrypted data buffer: offset 51 length 5022
* schannel: SSL/TLS handshake complete
* schannel: SSL/TLS connection with www.borhansys.com port 443 (step 3/3)
* schannel: stored credential handle in session cache
> GET /wp-content/plugins/css-ready-selectors/bashredirect/dxbway/YUGP8U/Zm9vQGJhci5jb20= HTTP/1.1
> Host: www.borhansys.com
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
> Accept: */*
>
* schannel: client wants to read 102400 bytes
* schannel: encdata_buffer resized 103424
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: encrypted data got 346
* schannel: encrypted data buffer: offset 346 length 103424
* schannel: decrypted data length: 317
* schannel: decrypted data added: 317
* schannel: decrypted data cached: offset 317 length 102400
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: decrypted data buffer: offset 317 length 102400
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 317
* schannel: decrypted data buffer: offset 0 length 102400
< HTTP/1.1 302 Found
< Location: https://blogging-for-money-tips.com/?email=Zm9vQGJhci5jb20=
< Content-Type: text/html; charset=UTF-8
< Content-Length: 0
< Date: Fri, 26 Apr 2019 19:17:58 GMT
< Accept-Ranges: bytes
< Server: LiteSpeed
< Cache-Control: no-cache, no-store, must-revalidate, max-age=0
< Connection: Keep-Alive
<
* Connection #0 to host www.borhansys.com left intact
* Issue another request to this URL: 'https://blogging-for-money-tips.com/?email=Zm9vQGJhci5jb20='
*   Trying 192.254.234.64...
* TCP_NODELAY set
* Connected to blogging-for-money-tips.com (192.254.234.64) port 443 (#1)
* schannel: SSL/TLS connection with blogging-for-money-tips.com port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 192 bytes...
* schannel: sent initial handshake data: sent 192 bytes
* schannel: SSL/TLS connection with blogging-for-money-tips.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* schannel: SSL/TLS connection with blogging-for-money-tips.com port 443 (step 2/3)
* schannel: encrypted data got 3671
* schannel: encrypted data buffer: offset 3671 length 4096
* schannel: sending next handshake data: sending 93 bytes...
* schannel: SSL/TLS connection with blogging-for-money-tips.com port 443 (step 2/3)
* schannel: encrypted data got 274
* schannel: encrypted data buffer: offset 274 length 4096
* schannel: SSL/TLS handshake complete
* schannel: SSL/TLS connection with blogging-for-money-tips.com port 443 (step 3/3)
* schannel: stored credential handle in session cache
> GET /?email=Zm9vQGJhci5jb20= HTTP/1.1
> Host: blogging-for-money-tips.com
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
> Accept: */*
>
* schannel: client wants to read 102400 bytes
* schannel: encdata_buffer resized 103424
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: encrypted data got 449
* schannel: encrypted data buffer: offset 449 length 103424
* schannel: decrypted data length: 420
* schannel: decrypted data added: 420
* schannel: decrypted data cached: offset 420 length 102400
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: decrypted data buffer: offset 420 length 102400
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 420
* schannel: decrypted data buffer: offset 0 length 102400
< HTTP/1.1 200 OK
< Server: nginx/1.14.1
< Date: Fri, 26 Apr 2019 19:17:59 GMT
< Content-Type: text/html
< Content-Length: 72
< Connection: keep-alive
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< Pragma: no-cache
< Set-Cookie: PHPSESSID=8e99e240a4b7a5b089aeb2ba2ec9b8f9; path=/
<
<script>window.location = 'another.php?email=Zm9vQGJhci5jb20=';</script>* Connection #1 to host blogging-for-money-tips.com left intact