May 16 2018, Russian doll phishing link

An interesting phishing email with a Russian doll base64 encoded link.
Why Russian doll, because it's package encode inside of encode packages.

Original URL within phishing email (line wrapped at 80 for readability)

http://alpha33.webredirect.org/beklcctmltr7/?r=aHR0cDovL2FscGhhMzMud2VicmVkaXJlY
3Qub3JnLzMxeDB6ZWhuamI1YWJlMDdlZmYyZDZmLzVhZmMzMDI3MDM4MDMvU205bExsVnpaWEpBYkc5e
lpYSXVZMjl0P2ZvcmNlZD0xJnRnPVYyVnpkQ0JGZFhKdmNHVT0mcz1aWGxLY0dScFNUWkpiVnBRVW5wT
01rNHlielZOYTBwRFdqRktibGw2YkZkUk1td3dZVVpGT1ZCVFNYTkpibHBvWWtoV2JFbHFiMmxoYTFKR
VdrZG9hMVZ1UmtKWFIxWkZaV3hLVjFkSGNHeGFXRTUwV1RGb2EwOUdkM1pVU0doRllXeFJOV1JVVmpCb
GJGSTFZV3BCTTFSRk9YZFdSbmQyWkZoYU5HUnVjRnBrUld0eVYxUkthazFITUROVGJWVXpUVmRXYTJNe
FpGZFVTRkpQVWpCWk5Vc3lWbEpTVkZKb1RucEtTbVZFVm5oU01IQlZUVlJLTkdWRVFuRk5XR3R5WTFWa
2JWSnRVa3BqYW1oeVZXcFJlVlpIUmtoVmJrcFNWRzFXUjFkcVRsVmFSR1F6V1cxYU5GTnFaRFJWVkdON
VpFWm9UMDlFU2pCTk1IQkVUVlp3UkU1RmVHbFNNMlIwVTBSS1YxWnFhRXhPV0U1VFRrZG9hMDFITkhkb
GJGVTVTV2wzYVdKWFJtcEphbTlwVFcxV2FWcFhWWGRPUkZKc1RYcGplbGxYVFRCT2FtUnBUV3BhYWsxV
VRURlpWR1JyV1cxTmQwOUViR2xQUkZFMVdsUlNhMDFVV1ROYVZFRTFXVlJWZUU1SFNURlpWRVYzVG5wU
2EwNHlUWGROUkdzeFRVTktPUT09

The section from above after ?r=
aHR0cDovL2FscGhhMzMud2VicmVkaXJlY3Qub3JnLzMxeDB6ZWhuamI1YWJlMDdlZmYyZDZmLzVhZmMz
MDI3MDM4MDMvU205bExsVnpaWEpBYkc5elpYSXVZMjl0P2ZvcmNlZD0xJnRnPVYyVnpkQ0JGZFhKdmNH
VT0mcz1aWGxLY0dScFNUWkpiVnBRVW5wT01rNHlielZOYTBwRFdqRktibGw2YkZkUk1td3dZVVpGT1ZC
VFNYTkpibHBvWWtoV2JFbHFiMmxoYTFKRVdrZG9hMVZ1UmtKWFIxWkZaV3hLVjFkSGNHeGFXRTUwV1RG
b2EwOUdkM1pVU0doRllXeFJOV1JVVmpCbGJGSTFZV3BCTTFSRk9YZFdSbmQyWkZoYU5HUnVjRnBrUld0
eVYxUkthazFITUROVGJWVXpUVmRXYTJNeFpGZFVTRkpQVWpCWk5Vc3lWbEpTVkZKb1RucEtTbVZFVm5o
U01IQlZUVlJLTkdWRVFuRk5XR3R5WTFWa2JWSnRVa3BqYW1oeVZXcFJlVlpIUmtoVmJrcFNWRzFXUjFk
cVRsVmFSR1F6V1cxYU5GTnFaRFJWVkdONVpFWm9UMDlFU2pCTk1IQkVUVlp3UkU1RmVHbFNNMlIwVTBS
S1YxWnFhRXhPV0U1VFRrZG9hMDFITkhkbGJGVTVTV2wzYVdKWFJtcEphbTlwVFcxV2FWcFhWWGRPUkZK
c1RYcGplbGxYVFRCT2FtUnBUV3BhYWsxVVRURlpWR1JyV1cxTmQwOUViR2xQUkZFMVdsUlNhMDFVV1RO
YVZFRTFXVlJWZUU1SFNURlpWRVYzVG5wU2EwNHlUWGROUkdzeFRVTktPUT09

The section above ran through Base64 decode = the URL below

http://alpha33.webredirect.org/31x0zehnjb5abe07eff2d6f/5afc302703803/Sm9lLlVzZXJ
AbG9zZXIuY29t?forced=1&tg=V2VzdCBFdXJvcGU=&s=ZXlKcGRpSTZJbVpQUnpOMk4ybzVNa0pDWjF
Kbll6bFdRMmwwYUZFOVBTSXNJblpoYkhWbElqb2lha1JEWkdoa1VuRkJXR1ZFZWxKV1dHcGxaWE50WTF
oa09Gd3ZUSGhFYWxRNWRUVjBlbFI1YWpBM1RFOXdWRnd2ZFhaNGRucFpkRWtyV1RKak1HMDNTbVUzTVd
Wa2MxZFdUSFJPUjBZNUsyVlJSVFJoTnpKSmVEVnhSMHBVTVRKNGVEQnFNWGtyY1VkbVJtUkpjamhyVWp
ReVZHRkhVbkpSVG1WR1dqTlVaRGQzWW1aNFNqZDRVVGN5ZEZoT09ESjBNMHBETVZwRE5FeGlSM2R0U0R
KV1ZqaExOWE5TTkdoa01HNHdlbFU5SWl3aWJXRmpJam9pTW1WaVpXVXdORFJsTXpjellXTTBOamRpTWp
aak1UTTFZVGRrWW1Nd09EbGlPRFE1WlRSa01UWTNaVEE1WVRVeE5HSTFZVEV3TnpSa04yTXdNRGsxTUN
KOQ==

Sm9lLlVzZXJAbG9zZXIuY29t	Base64 decode = [email protected]
V2VzdCBFdXJvcGU 			Base64 decode = West Europe

The section above after &s=
ZXlKcGRpSTZJbVpQUnpOMk4ybzVNa0pDWjFKbll6bFdRMmwwYUZFOVBTSXNJblpoYkhWbElqb2lha1JE
Wkdoa1VuRkJXR1ZFZWxKV1dHcGxaWE50WTFoa09Gd3ZUSGhFYWxRNWRUVjBlbFI1YWpBM1RFOXdWRnd2
ZFhaNGRucFpkRWtyV1RKak1HMDNTbVUzTVdWa2MxZFdUSFJPUjBZNUsyVlJSVFJoTnpKSmVEVnhSMHBV
TVRKNGVEQnFNWGtyY1VkbVJtUkpjamhyVWpReVZHRkhVbkpSVG1WR1dqTlVaRGQzWW1aNFNqZDRVVGN5
ZEZoT09ESjBNMHBETVZwRE5FeGlSM2R0U0RKV1ZqaExOWE5TTkdoa01HNHdlbFU5SWl3aWJXRmpJam9p
TW1WaVpXVXdORFJsTXpjellXTTBOamRpTWpaak1UTTFZVGRrWW1Nd09EbGlPRFE1WlRSa01UWTNaVEE1
WVRVeE5HSTFZVEV3TnpSa04yTXdNRGsxTUNKOQ==

Base64 decode = below
eyJpdiI6ImZPRzN2N2o5MkJCZ1JnYzlWQ2l0aFE9PSIsInZhbHVlIjoiakRDZGhkUnFBWGVEelJWWGpl
ZXNtY1hkOFwvTHhEalQ5dTV0elR5ajA3TE9wVFwvdXZ4dnpZdEkrWTJjMG03SmU3MWVkc1dWTHROR0Y5
K2VRRTRhNzJJeDVxR0pUMTJ4eDBqMXkrcUdmRmRJcjhrUjQyVGFHUnJRTmVGWjNUZDd3YmZ4Sjd4UTcy
dFhOODJ0M0pDMVpDNExiR3dtSDJWVjhLNXNSNGhkMG4welU9IiwibWFjIjoiMmViZWUwNDRlMzczYWM0
NjdiMjZjMTM1YTdkYmMwODliODQ5ZTRkMTY3ZTA5YTUxNGI1YTEwNzRkN2MwMDk1MCJ9

Base64 decode = below
{"iv":"fOG3v7j92BBgRgc9VCithQ==","value":"jDCdhdRqAXeDzRVXjeesmcXd8\/LxDjT9u5tzT
yj07LOpT\/uvxvzYtI+Y2c0m7Je71edsWVLtNGF9+eQE4a72Ix5qGJT12xx0j1y+qGfFdIr8kR42TaGR
rQNeFZ3Td7wbfxJ7xQ72tXN82t3JC1ZC4LbGwmH2VV8K5sR4hd0n0zU=","mac":"2ebee044e373ac4
67b26c135a7dbc089b849e4d167e09a514b5a1074d7c00950"}