Link: Mamba 2FA phishing kit
Link: Microsoft device code authentication with suspicious indicators
Link: Microsoft Dynamics 365 form phishing
Link: Microsoft protected message with suspicious recipient patterns
Link: Mismatched Shopify template button href
Link: Mixed case HTTPS protocol
Link: Multiple HTTP protocols in single URL
Link: Multistage landing - Abused Adobe frame.io
Link: Multistage landing - Abused Docusign
Link: Multistage landing - Abused Google Drive
Link: Multistage landing - ClickUp abuse
Link: Multistage landing - JotForm abuse
Link: Multistage landing - Ludus presentation
Link: Multistage landing - Scribd document
Link: Newly registered suspicious domain with single-character HTML filename
Link: Non-standard port 8443 in display URL
Link: Numeric IP obfuscation in URL
Link: Obfuscation via userinfo with excessive URL padding
Link: Obfuscation via userinfo with suspicious indicators
Link: Observed malicious URL path /redirect/redirect/
Link: Observed URL path (lht) with recipient email address
Link: .onion From Unsolicited Sender
Link: PDF display text with fake copyright claim template
Link: PDF file disguised as HTML page
Link: PDF filename impersonation with credential theft language
Link: QR code in EML attachment with credential phishing indicators
Link: Randomly generated subdomain
Link: Recipient email address in 'eta' parameter
Link: Referrer anonymization service from untrusted sender
Link: RTL text reversal with recipient email in URL
Link: ScreenConnect installer with suspicious relay domain
Link: Scribd fullscreen link from suspicious sender
Link: Secure SharePoint file share from new or unusual sender
Link: Self-sender credential theft with configuration placeholder
Link: Self-sender with IP geolocation check and suspicious link behavior
Link: Self-sender with sender org in subject and credential theft indicator
Link: Self-sent message with quarterly document review request
Link: Self-sent PDF lure with subject correlation
Link: SharePoint files shared from GoDaddy federated tenants
Link: SharePoint OneNote or PDF link with self sender behavior
Link: Shortened URL with fragment matching subject
Link: Single character path with credential theft body and self sender behavior or invalid recipient
Link: Spam website with evasion indicators
Link: .su domain link redirection from new sender domains
Link: Suspicious Family fragment parameter with encoded recipient data
Link: Suspicious go.php redirect with document lure
Link: Suspicious recipient with timeout redirect
Link: Suspicious SharePoint document name
Link: Suspicious Sharepoint folder share
Link: Suspicious URL path with binary character sequence