Link: Multistage landing - FreshDesk knowledge base abuse
Link: Multistage landing - JotForm abuse
Link: Multistage landing - Ludus presentation
Link: Multistage landing - Microsoft Forms abuse
Link: Multistage landing - Published Google Doc
Link: Multistage landing - Scribd document
Link: Multistage landing - Trello board abuse
Link: MyActiveCampaign Link Abuse
Link: Newly registered domain in reference lure
Link: Newly registered suspicious domain with single-character HTML filename
Link: Observed malicious URL path /redirect/redirect/
Link: Observed URL path (lht) with recipient email address
Link: .onion From Unsolicited Sender
Link: PDF and financial display text to free file host
Link: PDF filename impersonation with credential theft language
Link: Personalized URL with recipient address on commonly abused web service
Link: Personal SharePoint with invalid recipients and credential theft language
Link: Possible Intuit link abuse
Link: QR code with phishing disposition in img or pdf
Link: QR Code with suspicious language (untrusted sender)
Link: QuickBooks image lure with suspicious link
Link: Recently registered .vu domain in lure
Link: Recipient email address in 'eta' parameter
Link: Remittance payment request with timeline template
Link: RFI document reference pattern in display text
Link: Romance/Sexual Language With Suspicious Link
Link: RTL text reversal with recipient email in URL
Link: ScreenConnect installer with suspicious relay domain
Link: ScreenConnect remote access tool delivery with unattended guest access
Link: Scribd fullscreen link from suspicious sender
Link: Self-sender credential theft with configuration placeholder
Link: Self-sender with IP geolocation check and suspicious link behavior
Link: Self-sender with sender org in subject and credential theft indicator
Link: Self-sent message with quarterly document review request
Link: Self-sent PDF lure with subject correlation
Link: Self-service platform link to Microsoft login redirect
Link: SharePoint filename matches org name
Link: Shortened URL with fragment matching subject
Link: Single character path with credential theft body and self sender behavior or invalid recipient
Link: Squarespace infrastructure abuse
Link: .su domain link redirection from new sender domains
Link: Suspicious Family fragment parameter with encoded recipient data
Link: Suspicious file retrieval with recipient targeting
Link: Suspicious go.php redirect with document lure
Link: Suspicious HTML structure with subject mirrored in body and single link
Link: Suspicious Loom HTML file path
Link: Suspicious recipient with timeout redirect
Link: Suspicious single-domain link with suspicious path and financial lure indicators
Link: Suspicious TLD hosting client.js with cf beacon
Link: Suspicious URL with recipient targeting and special characters