SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises

SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at risk of unauthorized access. The ANY.RUN team identified 618 sandbox analyses related to SkyW4lker between June and October 21, 2026, with 46% of submissions coming from the United States. Activity increased from 20 analyses in June to 200 in September, highlighting the growing exposure of organizations relying on Microsoft 365. Key Takeaways SkyW4lker is distributed through phishing emails with a password-protected malicious attachment; the password is provided in the email body. After a chain of decoy pages, the victim reaches a page that asks for a Microsoft device code. The kit consists of a PHP backend and obfuscated JavaScript. Its main features are IP-based geolocation of visitors and periodic polling of the backend to check whether the victim has completed authentication. ANY.RUN’s powerful new capability, Related Threat Context, helped analysts accelerate the SkyW4lker investigation by instantly surfacing connections to previous sandbox analyses. This reduced manual correlation work, enabled faster expansion of the campaign cluster, and ultimately helped uncover the phishing kit’s administration panel. As a result, 618 analyses were identified over the past six months (as of October 21, 2026), with monthly submissions growing from 20 in June to 200 in September. They were submitted mainly by organizations in the technology, manufacturing, and government sectors, most often from the United States, India, Canada, and the United Kingdom. SkyW4lker shares its JavaScript modules, landing-URL format, and part of its hosting infrastructure with Gabagool, a credential phishing kit active since April 2026. We assess with high confidence that both kits were built by the same developer. SkyW4lker exploits routine business workflows, using contracts, invoices, and service proposals as phishing lures. By directing employees through familiar platforms and legitimate Microsoft authentication pages, attackers make malicious requests harder to distinguish from normal business activity. SkyW4lker Threat Overview Threat Type Phishing Kit Objective Microsoft 365 / OAuth credentials Capabilities JavaScript obfuscation (obfuscator.io), Device-Code phishing, Geolocation detection, IP-address detection, CAPTCHA verification Delivery Email attachments (.pdf, .docx, .xls/xlsx and others), redirection links and lure pages (including Google Maps, Google Images, Miro, Zoom and others) Motivation Possible financial Operator / brand SkyW4lker (SkyW4lker x365 Sentinel) Known links URL patterns: /session_public.php?action= /endpoints/confirm_visit.php /js/url_helper.js /js/endpoint.js /js/client_geo.js Activity window 2026-06 – now SkyW4lker Activity Across US Organizations The United States accounts for 47% of SkyW4lker-related sandbox submissions, more than twice the share of any other country. With the campaign exploiting legitimate Microsoft authentication processes and routine business communications, these findings raise concerns for US enterprises about how effectively existing security controls can identify suspicious activity before it leads to account compromise. SkyW4lker phishkit attack overview What SkyW4lker Means for Enterprise Security SkyW4lker highlights several security risks that organizations need to account for when protecting business-critical systems and employee identities: Identity security gaps: Device-code phishing can succeed even when MFA is enabled, raising questions about whether existing authentication policies sufficiently restrict unnecessary access methods. Detection challenges: Attackers abuse legitimate Microsoft authentication flows and trusted platforms, making it harder for security teams to distinguish malicious activity from normal employee behavior. Broader organizational exposure: A compromised account could provide access to multiple business applications and create opportunities for further attacks against employees, customers, and partners. Higher response costs: Investigating suspicious authentication activity, identifying affected resources, and containing unauthorized access can increase SOC workload and incident response costs. Stop account compromise before it disrupts your business.Detect threats earlier and reduce response costs. Reduce Incident Impact Technical Analysis of SkyW4lker You can examine the full SkyW4lker attack chain in this ANY.RUN Sandbox analysis. View analysis session and gather IOCs PDF lure document analyzed inside ANY.RUN sandbox The attack unfolds in three main stages: The attacker sends the victim a phishing email with a password-protected attachment. Typical subjects involve commercial offers, contracts, invoices, or confidential documents. The attachment is a PDF, DOCX, or XLSX file, and the password is provided in the email body. The document contains a link to a CAPTCHA page. Some variants include an additional lure page hosted on a legitimate service such as Miro, Google Sites, or Zoom, which redirects the victim to the next step. Finally, the victim is directed to a phishing page that instructs them to enter a device code on Microsoft’s legitimate authentication page, potentially granting the attacker access to their Microsoft 365 account. Phishing page analyzed inside ANY.RUN sandbox The phishing page relies on obfuscated JavaScript functions and separate script files. Using ANY.RUN’s In-Browser Data Inspection, analysts can examine the page’s DOM and HTTP activity to understand how these scripts operate. Fragment of the phishing page in the Browser Data section The scripts keep the page in regular contact with the PHP backend and determine the location of the victim from their IP address. Within the page DOM, the main script loads additional modules, sets click handlers on buttons and builds GET requests to the PHP endpoint /session_public.php with the action parameter (start or poll). With action=start, the script sends the geolocation and IP address of the victim and receives a session ID. After that, it sends a request with action=poll every few seconds to check whether the victim has authenticated. Periodic GET requests from the phishing page The other modules of the phishing page are listed below: Module Purpose client_geo.js Determines the location of the victim from the response of one of three services: ip-api[.]com, ipapi[.]co or ipwho[.]is. The location can also be obtained through the PHP endpoint php/endpoints/client_geo.php. url_helper.js Base script with helper wrappers for URL handling, such as building GET parameters and appending slashes. endpoint.js Tracks the state of the victim. It logs the e-mail address, password, browser, MFA status, country and other auxiliary fields used during authentication and sends them to the PHP backend at php/endpoints/accounts.php. A single phishing URL can be the starting point for uncovering an entire campaign. In the SkyW4lker investigation, identifying the malicious page was only the beginning. Analysts needed to trace related activity, identify additional infrastructure, and determine how far the campaign extended. Traditionally, connecting these findings requires repeated IOC lookups, manual correlation, and searching through previous investigations. ANY.RUN’s major new upgrade, Related Threat Context, makes this process significantly faster and easier. By bringing connections to previous sandbox investigations and threat intelligence directly into the Interactive Sandbox, it helps analysts discover related threats, reuse existing findings, and expand investigations with fewer manual steps. Related Threat Context window with similar URLs in other analyses With more than 700,000 security professionals and 16,000 organizations worldwide using ANY.RUN, analysts can draw on a vast pool of real-world investigation data to uncover connections that might otherwise take considerably longer to find. During our SkyW4lker investigation, the new Related analyses section surfaced previous sandbox sessions sharing the same URL patterns. This gave analysts an immediate starting point for tracing related activity instead of manually searching for connections across individual investigations. Using the distinctive PHP endpoint /session_public.php, we moved into ANY.RUN Threat Intelligence Lookup in a single click, discovered additional phishing activity, and expanded the campaign cluster. TI Lookup query for the unique URL pattern The investigation demonstrates the practical value of Related Threat Context: less time spent searching for connections, faster discovery of related infrastructure, and more evidence available to guide the next investigation step. Reduce Manual Triage and Strengthen SOC Investigations The same approach can be applied to other suspicious URLs and indicators, allowing SOC teams to build on previous investigations and uncover related threat infrastructure faster. Tier 1 analysts spend less time on repetitive IOC research, gaining more evidence to support accurate triage and escalation decisions. Tier 2 analysts receive richer investigation context, helping them focus on cases that genuinely require deeper analysis. By connecting individual alerts to existing threat intelligence, Related Threat Context helps SOC teams shorten investigation cycles, reduce unnecessary manual work, and make better-informed response decisions. Give your SOC the context they need for faster triage.Cut repetitive investigations. Increase Tier 1 productivity. Boost Your SOC Now Attribution: The Connection Between SkyW4lker and Gabagool Each phishing page has its own backend, so the administration panel is likely to be hosted on the same domain. Further analysis of the Threat Intelligence Lookup results and data from other sources revealed an administration panel at /admin/index.php. Login form of the administration panel The CSS styles (command-center.css) suggest the following capabilities of the kit: Authentication with MFA via Telegram Dashboard with victim statistics based on the client_geo.js module Server management Generation of new links Live notifications about new visits to phishing links Example of class names in the CSS file Further investigation revealed another important finding: SkyW4lker shares several technical components with Gabagool, a credential phishing kit. A search in ANY.RUN Threat Intelligence for the unique module paths of SkyW4lker url:”/js/client_geo.js” or url:”/js/url_helper.js” or url:”/js/endpoint.js”) also returns sandbox sessions tagged gabagool. Gabagool was first observed on 23 April 2026, two months before SkyW4lker, and has used the endpoint.js and url_helper.js modules since late April and early May. The two kits share several other features: Feature SkyW4lker Gabagool First seen 23 June 2026 23 April 2026 Analyses in six months 618 458 Shared JavaScript modules client_geo.js, url_helper.js, endpoint.js (since July 2026) client_geo.js, url_helper.js, endpoint.js (since late April 2026) Visit endpoint /assets/php/endpoints/confirm_visit.php /assets/php/endpoints/confirm_visit.php Self-hosted CAPTCHA /assets/private_captcha/public/widget.js?v=4 /assets/private_captcha/public/widget.js?v=4 Landing token zt[A-Za-z0-9]{32}op; it[A-Za-z0-9]{32}us from 10 August zt[A-Za-z0-9]{32}op; it[A-Za-z0-9]{32}us from 5 August Same directory on shared hosts 5200m[.]com/kvme2/ (16 Oct), torvion[.]life/ofulium/ (5 Oct), ghethim[.]com/hyllen/ (28 Sep – 2 Oct) 5200m[.]com/kvme2/ (15 Oct), torvion[.]life/ofulium/ (6 Oct), ghethim[.]com/hyllen/ (8 Oct) Hosting mostly DigitalOcean mostly DigitalOcean; shared IP 172.86.85[.]51 (priorispace[.]biz) Main endpoint session_public.php (device-code phishing) accounts.php (login and password harvesting) Moreover, some sandbox sessions tagged gabagool load the kit from directories named skywalker: goldcreekconcrete[.]com/example/skywalker/ (sandbox session) and goldcreekconcrete[.]com/skywalker/example/ (sandbox session). On goldcreekconcrete[.]org, which also hosted Gabagool (sandbox session), the directory /skyw4lker/skydirectory/ with the same modules appeared on 29 September (sandbox session). We therefore assess with high confidence that Gabagool and SkyW4lker are built by the same developer. Gabagool harvests logins and passwords through accounts.php, whereas SkyW4lker abuses the device-code flow through session_public.php, so we regard them as two attack modes of one platform. The identical directories on shared hosts may also point to a common operator; however, the available data does not allow us to distinguish one operator from several customers of the same platform. How to Detect SkyW4lker and Reduce Enterprise Exposure The SkyW4lker investigation reveals several technical indicators and attack patterns that security teams can use to identify related phishing activity. For organizations, these findings also highlight opportunities to strengthen identity security and reduce the impact of potential account compromise. For SOC Analysts and Threat Hunters Hunt for SkyW4lker’s technical fingerprints. Look for requests to /session_public.php?action=start and repeated /session_public.php?action=poll calls. Check the JavaScript modules and URL patterns identified in this research to uncover related infrastructure. Connect phishing activity with suspicious sign-ins. Monitor Microsoft Entra ID logs for unexpected device-code authentication, particularly following suspicious emails or document-sharing requests. Correlating authentication events with phishing indicators can help identify potential account compromise. Expand investigations beyond individual IOCs. ANY.RUN’s newly introduced Related Threat Context puts connected sandbox analyses at analysts’ fingertips, with a one-click pivot to threat intelligence context for deeper threat hunting. In the SkyW4lker investigation, this helped expand the campaign cluster, while further analysis revealed shared infrastructure and code similarities with Gabagool. Investigate potential follow-on activity. When account compromise is suspected, review subsequent Microsoft 365 activity to identify affected resources, unauthorized access, and possible attempts to target other users. Give Tier 1 the evidence to make faster decisions.Keep more cases at Tier 1 with 30% fewer escalations. Improve SOC Efficiency For CISOs and Security Leaders SkyW4lker demonstrates why organizations need to look beyond traditional phishing prevention and MFA when evaluating identity security. Three priorities deserve attention: Close authentication policy gaps. Review where device-code authentication is genuinely required. Restrict or block unnecessary use through Microsoft Entra Conditional Access to reduce opportunities for attackers to abuse legitimate authentication flows. Strengthen detection across email and identity systems. Ensure the SOC can connect suspicious attachments, phishing infrastructure, and unusual authentication events. Better visibility across these stages helps teams identify potential compromises before attackers expand their access. Reduce investigation time and escalation costs. Equip Tier 1 analysts with historical threat context and clear escalation criteria. Establish procedures for containing compromised accounts and reviewing unauthorized activity, helping Tier 2 teams focus on incidents requiring deeper investigation. Conclusion SkyW4lker continues to evolve, with new endpoints, changing URL patterns, and growing activity across sandbox analyses. Its connection to Gabagool suggests that the same developer is supporting both device-code and credential phishing, giving attackers different ways to compromise business accounts through shared infrastructure. For organizations, the findings highlight a broader security challenge: attackers are increasingly exploiting legitimate authentication processes and trusted business services, making malicious activity harder to distinguish from normal operations. As phishing kits evolve, security teams need more than traditional email filtering and MFA. Stronger identity controls, visibility into suspicious authentication activity, and access to connected threat context can help SOCs identify attacks earlier, investigate them faster, and reduce the potential impact on business operations. About ANY.RUN ANY.RUN provides cybersecurity solutions that help SOC and MSSP teams detect and investigate threats, make faster decisions, and reduce the time and resources spent on incident response. The company’s solutions include Interactive Sandbox for analyzing suspicious files, URLs, and phishing attack chains, and ANY.RUN Threat Intelligence with Threat Intelligence Lookup, Threat Intelligence Feeds, and Threat Intelligence Reports. Together, these solutions help security teams uncover related threat activity, track evolving attack infrastructure, and strengthen detection with intelligence from real-world investigations. Today, ANY.RUN is trusted by more than 16,000 organizations and 700,000 security professionals worldwide. The company is SOC 2 Type II certified, with security controls designed to protect customer data. TTPs (MITRE ATT&CK) Tactic Technique Procedure Reconnaissance T1589.002 Gather Victim Identity Information: Email Addresses The SkyW4lker operator collected recipient e-mail addresses to personalise phishing links using the landing-URL suffix ? or ?? after /it[A-Za-z0-9]{32}us. Reconnaissance T1590.005 Gather Victim Network Information: IP Addresses The SkyW4lker phishing kit recorded the visitor's IP address, ISP, organisation and location to profile victims using client_geo.js and the request /assets/php/endpoints/session_public.php?action=start&ip=…&isp=…&org=…&org_type=. Resource Development T1583.001 Acquire Infrastructure: Domains The SkyW4lker operator registered look-alike domains of real companies to host phishing pages using typo-squatted names under Microsoft-themed subdomain chains, e.g. sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com and pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com. Resource Development T1583.001 Acquire Infrastructure: Domains The SkyW4lker operator obtained free dynamic-DNS subdomains to host phishing pages using flow505.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab[.]com. Resource Development T1583.003 Acquire Infrastructure: Virtual Private Server The SkyW4lker operator rented virtual private servers to run the PHP backend using DigitalOcean hosting (50 of 92 backend IP addresses), e.g. 162.243.64[.]121 and 67.205.154[.]32. Resource Development T1608.005 Stage Capabilities: Link Target The SkyW4lker operator staged intermediate pages to forward victims to the kit using public cloud buckets and site builders, e.g. pub-177b3aa5a54d4f9087a649de5ec766d5.r2[.]dev/docsonedrive2026.html, carcabaoperadologistca.fr-par-1.linodeobjects[.]com/document_excel.html and bethom-contracting-llc.mintlify[.]site. Initial Access T1566.001 Phishing: Spearphishing Attachment The SkyW4lker operator sent password-protected attachments to deliver the phishing link using PDF, XLS, DOCX and EML lures named -protected.pdf or DOC .pdf, e.g. SHA256 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268. Initial Access T1566.002 Phishing: Spearphishing Link The SkyW4lker operator sent links hosted on legitimate services to pass e-mail reputation checks using Google Sites, Axure Cloud and Smartsheet pages and the maps.google[.]ie/url?q= redirect, e.g. sites.google[.]com/heatherrasekhomes.com/talbert-manufacturing-inc-0049/home. Execution T1204.001 User Execution: Malicious Link The SkyW4lker phishing kit relied on the victim opening the landing link to start a phishing session using the path //it[A-Za-z0-9]{32}us. Defense Evasion T1656 Impersonation The SkyW4lker operator imitated routine business correspondence to make the lures credible using subjects such as New Submission From , Approved Statement and Fedwire Funds Service Processed-()-. Defense Evasion T1497 Virtualization/Sandbox Evasion The SkyW4lker phishing kit placed a CAPTCHA in front of the phishing page to hide it from automated scanners using Cloudflare Turnstile and the self-hosted /assets/private_captcha/public/widget.js?v=4 with /assets/php/endpoints/private_captcha_challenge.php. Defense Evasion T1027 Obfuscated Files or Information The SkyW4lker phishing kit obfuscated its JavaScript to hinder analysis using obfuscator.io-style code (520 of 618 analyses carry the obfuscated-js tag). Credential Access T1528 Steal Application Access Token The SkyW4lker phishing kit abused the Microsoft OAuth 2.0 device-code flow to obtain the victim's access tokens using login.microsoft[.]com/device and login.microsoftonline[.]com/common/oauth2/deviceauth while polling /assets/php/endpoints/session_public.php?action=poll&session_id=. Collection T1056.003 Input Capture: Web Portal Capture The SkyW4lker phishing kit logged the victim's e-mail, password, browser, MFA status and country to collect credentials using endpoint.js and the backend php/endpoints/accounts.php. IOCs All indicators were observed in ANY.RUN analyses between 23 June and 21 October 2026. URL patterns: Pattern Purpose Seen //it[A-Za-z0-9]{32}us Landing page token; may end with ? or ?? 2026-08-10 – 2026-10-19 //zt[A-Za-z0-9]{32}op Earlier landing page token 2026-06-25 – 2026-09-28 /assets/php/endpoints/session_public.php?action=start&ip=&ip_address=&country=&country_code=&IP[ip]=&IP[country]=&city=…®ion=…&timezone=…&isp=…&org=…[&org_type=IPv4] Session registration with visitor geolocation 2026-06-23 – 2026-10-21 /assets/php/endpoints/session_public.php?action=poll&session_id= Polling of device-code authentication status 2026-06-23 – 2026-10-21 /assets/js/client_geo.js Visitor geolocation module 2026-07-07 – 2026-10-19 /assets/js/endpoint.js Session state and credential logging module 2026-07-22 – 2026-10-20 /assets/js/url_helper.js URL helper module 2026-07 – 2026-10 /assets/php/endpoints/confirm_visit.php Visit confirmation endpoint 2026-08-31 – 2026-10-15 /assets/private_captcha/public/widget.js?v=4, /assets/private_captcha/public/widget.css, /assets/php/endpoints/private_captcha_challenge.php Self-hosted CAPTCHA gate 2026-07-07 – 2026-09-28 /assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}.js Brand-specific document script 2026-07-20 – 2026-10-20 (docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth).*(outlook|onedrive|copilot|office365).*. Microsoft-themed hostname chain on look-alike domains 2026-06 – 2026-10 Domains hosting the phishing kit (173): 0350pvas.acs-wcst[.]com 0ff365access.mooo[.]com 0utlook0ffice365admin.twilightparadox[.]com 1355bcra.ck29material[.]com 1717emxr.acs-wcst[.]com 5200m[.]com 5375jngu.prefform[.]us 6662nyde.acs-wcst[.]com 6695lkmo.prefform[.]us 7301eqny.acs-wcst[.]com 7criccasinobonus[.]cc aachem-za[.]co accordhealth[.]cc acrobat-adobe-com-4464uswc.egllo[.]com advancedsteelbuilding[.]com alasilla[.]com albertamo[.]com alfabricationinc[.]com apexpartsdepot[.]com apinows[.]com atlantictriad.ignorelist[.]com atlassgroupinc[.]com auth-loadingdocuments[.]online auth.login.office365.cloud.onedrive.outlook.atlarchitacts[.]com authorize.copilot.outlook.common.microsoft0365.atlarchitacts[.]com awemode.outlookoffice365.microsoftcopilots.docshare.linnwest[.]us azgymfloor[.]com bandg-electrics[.]com bennett002.mooo[.]com bezpartien[.]online bigbrain.chickenkiller[.]com bloomfleldcapital[.]com bramum[.]online buckslu[.]org bxcelcounselling[.]org caine-wenier[.]com calebchemicals[.]com calmechc[.]net canacedesotogroup[.]com celestialtremor[.]org celliottelliott-wellman[.]org celvarioncorn[.]org centipedtourspa[.]com claronevents[.]com cleggs.my03[.]com clingard[.]pro clubdenut[.]club copilot.login.office365outlook.cloud.onedrive.atlarchitacts[.]com copilots.outlook.cloud.microsoft.andersonelevators[.]com copilots.outlook.cloud.microsoft.syrosconstructlon[.]com coreansdmain[.]com csr-rooflng[.]com ctr-wooding[.]com darap-it[.]co detroitgardenswork[.]com devtachsales[.]com dguidrycardinazprofessional[.]com docshare.auth.copilot.outlook.onedrive.common.earthlink-net[.]com docshare.auth.copilot.outlook.onedrive.common.evergreenerg[.]com docshare.auth.copilot.outlook.onedrive.common.northemheating[.]com docshare.auth.copilot.outlook.onedrive.common0.evergreenerg[.]com docshare.auth.copilot.outlookonedrive.common.northemheating[.]com docshare.auth2026.onedrive.outlooksdocument.csr-rooflng[.]com docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng[.]com document.akiflx[.]com dpincoli[.]com dutchfarrms[.]com eccentric-authentication[.]com ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc[.]com efaxdoc.auth.login.outlook.office365.tescoccontrols[.]com efaxdoc.auth.outlook2026common.copilos26.bettylnc[.]com efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr[.]com efaxdoc.auth.outlook2026common.copilos26.kone-inc[.]com efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc[.]com efaxdoc.documents2026.docs.shared.lakeviewscustom[.]com eurosforgroup[.]com flow505.mooo[.]com flow55.chickenkiller[.]com fosterswifts[.]com frontdesk[.]click gcotoncovingtoncontracting[.]com ghethim[.]com glafondbottamconstruction[.]com globlasumi[.]com gregor.justdied[.]com grincool[.]xyz haevy-llc[.]com hcnyecom[.]com hivezoom[.]com ideahom[.]world incommecialre[.]com innvisoin[.]net insigthinvestments[.]com investomind[.]biz jacobpwpinc[.]org jjnysnobiogtx[.]org kilishy.qhigh[.]com kuer[.]online lampadasdeslgn[.]com lawyer.cuztools[.]com lifetimeroofsystem[.]net linking.mefound[.]com linogomes-pt[.]cc lionheartsecurityservice[.]com liyuda[.]com login.microsoft365.outlook.copilotsoffice365.lntactpr[.]com login.office365outlooks.microsoft.cloud-outlook.naregruop[.]com m365cloud.login.outlook.office365.azgymfloor[.]com maqaigiapelhani[.]cam metlarnelaw[.]com metrorocl.co[.]uk mgproparties[.]com minda-mo[.]com mouphyweb[.]com naregruop[.]com nicewayrealestate[.]cc noxband[.]com off365acess.jumpingcrab[.]com off365mail[.]club office0365login.2waky[.]com outlookdrive.microsoftonline.common.oauth2.client.buycerm[.]com outlookoffice365.microsoftcopilots.vigilantlnc[.]com paulecosconnect[.]com payapp.auth.outlook2026common.copilos26.bettylnc[.]com pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr[.]com pdlhaelth[.]com pdocshared.documents2026.docs.shared.ecmholdlnggroup[.]com pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com photosofus[.]com plusoptlx[.]com priorispace[.]biz psionicsandhorses[.]net rapid-scale[.]net reauth.copilot.auth.outlook.mcloud365.buycerm[.]com reauth.copilot.auth.outlook.mcloud365.myhalnc[.]com reauth.copilot.common.outlook.mcloud365.atlarchitacts[.]com reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras[.]com rektham[.]online rubinsrudman[.]com rustlnsurance[.]com sdocshares.auth.outlook.copilos26.general.csr-rooflng[.]com sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com sdocshares.authoutlooks.common.copilots2026.hathormson[.]com seatacsmarine[.]com sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer[.]com shared.paymentsclouds.statementsapproved.jetbusinesscapltal[.]com slybee[.]com snk-s[.]org solutions00fileptroduct[.]com sorensenmaysflower[.]blog statement.docdriveoauth.authorized.copilot.syrosconstructlon[.]com statement.outlookoffice365.microsoftcopilots.calmechc[.]net statements.outlook.office365microsoft.payment.run.stoneclty[.]com stellarntis-fs[.]com studeseliamechan[.]link sunraycontractlng[.]com sunstateaquips[.]com swiftii.chickenkiller[.]com tentkit[.]com thepaybank[.]com thewiginton[.]com topcoatmetalsfinishing[.]com toplinebuy[.]com torvion[.]life unitadrentals[.]com unitedwirescompany[.]com us-agricultures[.]com vasquezmyth[.]com westlakeproduces[.]com whitfillsnursery[.]com wsochares.authpayments.common.paid2026.bullochdirtwroks[.]com wwriwashingtonenergy[.]com zrs-wooding[.]com