Link: ScreenConnect installer with suspicious relay domain
Link: ScreenConnect remote access tool delivery with unattended guest access
Link: Scribd fullscreen link from suspicious sender
Link: Self-sender credential theft with configuration placeholder
Link: Self-sender with IP geolocation check and suspicious link behavior
Link: Self-sender with sender org in subject and credential theft indicator
Link: Self-sent message with quarterly document review request
Link: SharePoint filename matches org name
Link: SharePoint files shared from GoDaddy federated tenants
Link: SharePoint OneNote or PDF link with self sender behavior
Link: Shortened URL with fragment matching subject
Link: Single character path with credential theft body and self sender behavior or invalid recipient
Link: Spam website with evasion indicators
Link: Squarespace infrastructure abuse
Link: Suspicious Family fragment parameter with encoded recipient data
Link: Suspicious file retrieval with recipient targeting
Link: Suspicious go.php redirect with document lure
Link: Suspicious Loom HTML file path
Link: Suspicious Sharepoint folder share
Link: Suspicious single-domain link with suspicious path and financial lure indicators
Link: Suspicious URL path with binary character sequence
Link: Suspicious URL with recipient targeting and special characters
Link: Suspicious wp-admin path from mismatched sender domain
Link: SVG with embedded recipient data
Link: Tax document lure Portuguese/Spanish with suspicious domains
Link to a domain with punycode characters
Link to auto-downloaded disk image in encrypted zip
Link to auto-downloaded DMG in archive
Link to auto-downloaded DMG in encrypted zip
Link to auto-downloaded file with Adobe branding
Link to auto-downloaded file with Google Drive branding
Link to auto-download of a suspicious file type (unsolicited)
Link to Google Apps Script macro (unsolicited)
Link to Google Apps Script macro via comment tagging
Link: Tycoon2FA phishing kit (non-exhaustive)
Link: Uncommon SharePoint document type with sender's display name
Link: Unformatted template with literal placeholder in mailto link
Link: Unsolicited email contains link leading to Tycoon URL structure
Link: Unsolicited email contains link to page containing Tycoon URI structure
Link: URL fragment with hexadecimal pattern obfuscation
Link: URL path containing /moni/index
Link: URL redirecting to blob URL
Link: URL scheme obfuscation via split HTML anchors
Link: URL shortener with copy-paste instructions and credential theft language
Link: Webflow link from unsolicited sender
Link: WordPress admin targeting with recipient identifier in URL parts
Link: WordPress login page with Blogspot Binance scam
Link: Zoho form link from unsolicited sender
Low reputation link to auto-downloaded HTML file with smuggling indicators