Observable:
eaosharefiledocx[.]us-sea-1[.]linodeobjects[.]com
djcsharefiledoc-844[.]us-sea-1[.]linodeobjects[.]com
ekhealthsharefiledoc8786[.]us-sea-1[.]linodeobjects[.]com
grsrecruitmentsharefiledocx[.]us-sea-1[.]linodeobjects[.]com
alleviatepainsharefiledoc-0908[.]us-sea-1[.]linodeobjects[.]com
cardlnahealth[.]com
ipolicesupply[.]com
ahnnv-sharefiledoc[.]us-sea-1[.]linodeobjects[.]com (down)
sharefiledoc22090statementpdf0365[.]us-sea-1[.]linodeobjects[.]com (down)
Observable Type: Domain
Details: Microsoft M365 Phishing
Uses compromised accounts to send to contact list posing as statement → User clicks link to 0ffline.html page which poses as a M365 login. Gets resources from cloudflare, microsoft, and the Cardinal Health typosquat. → Creds are posted to the police supply domain, cardinal typosquat as well as IP info gathered from ipapi[.]co . They check if the creds are correct and if MFA is enabled.
{“email":"[snip]”,“password”:“[snip]”,“IP”:“[snip]”,“browser”:“Firefox”,“Type”:“Microsoft”,“login_result”:“Failed”,“MFA_status”:“Disabled”,“country”:“United States”,“date”:“2026-02-20 20:57:33”,“ss_id”:497262}
