SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at risk of unauthorized access.

The ANY.RUN team identified 618 sandbox analyses related to SkyW4lker between June and October 21, 2026, with 46% of submissions coming from the United States. Activity increased from 20 analyses in June to 200 in September, highlighting the growing exposure of organizations relying on Microsoft 365.

Key Takeaways

• SkyW4lker is distributed through phishing emails with a password-protected malicious attachment; the password is provided in the email body. After a chain of decoy pages, the victim reaches a page that asks for a Microsoft device code.
• The kit consists of a PHP backend and obfuscated JavaScript. Its main features are IP-based geolocation of visitors and periodic polling of the backend to check whether the victim has completed authentication.
• ANY.RUN’s powerful new capability, Related Threat Context, helped analysts accelerate the SkyW4lker investigation by instantly surfacing connections to previous sandbox analyses. This reduced manual correlation work, enabled faster expansion of the campaign cluster, and ultimately helped uncover the phishing kit’s administration panel.
• As a result, 618 analyses were identified over the past six months (as of October 21, 2026), with monthly submissions growing from 20 in June to 200 in September. They were submitted mainly by organizations in the technology, manufacturing, and government sectors, most often from the United States, India, Canada, and the United Kingdom.
• SkyW4lker shares its JavaScript modules, landing-URL format, and part of its hosting infrastructure with Gabagool, a credential phishing kit active since April 2026. We assess with high confidence that both kits were built by the same developer.
• SkyW4lker exploits routine business workflows, using contracts, invoices, and service proposals as phishing lures. By directing employees through familiar platforms and legitimate Microsoft authentication pages, attackers make malicious requests harder to distinguish from normal business activity.

SkyW4lker Threat Overview

Threat Type	Phishing Kit
Objective	Microsoft 365 / OAuth credentials
Capabilities	JavaScript obfuscation (obfuscator.io), Device-Code phishing, Geolocation detection, IP-address detection, CAPTCHA verification
Delivery	Email attachments (.pdf, .docx, .xls/xlsx and others), redirection links and lure pages (including Google Maps, Google Images, Miro, Zoom and others)
Motivation	Possible financial
Operator / brand	SkyW4lker (SkyW4lker x365 Sentinel)
Known links	URL patterns: /session_public.php?action= /endpoints/confirm_visit.php /js/url_helper.js /js/endpoint.js /js/client_geo.js
Activity window	2026-06 – now

SkyW4lker Activity Across US Organizations

The United States accounts for 47% of SkyW4lker-related sandbox submissions, more than twice the share of any other country. With the campaign exploiting legitimate Microsoft authentication processes and routine business communications, these findings raise concerns for US enterprises about how effectively existing security controls can identify suspicious activity before it leads to account compromise.

What SkyW4lker Means for Enterprise Security

SkyW4lker highlights several security risks that organizations need to account for when protecting business-critical systems and employee identities:

• Identity security gaps: Device-code phishing can succeed even when MFA is enabled, raising questions about whether existing authentication policies sufficiently restrict unnecessary access methods.
• Detection challenges: Attackers abuse legitimate Microsoft authentication flows and trusted platforms, making it harder for security teams to distinguish malicious activity from normal employee behavior.
• Broader organizational exposure: A compromised account could provide access to multiple business applications and create opportunities for further attacks against employees, customers, and partners.
• Higher response costs: Investigating suspicious authentication activity, identifying affected resources, and containing unauthorized access can increase SOC workload and incident response costs.

Technical Analysis of SkyW4lker

You can examine the full SkyW4lker attack chain in this ANY.RUN Sandbox analysis.

View analysis session and gather IOCs

The attack unfolds in three main stages:

1. The attacker sends the victim a phishing email with a password-protected attachment. Typical subjects involve commercial offers, contracts, invoices, or confidential documents. The attachment is a PDF, DOCX, or XLSX file, and the password is provided in the email body.

2. The document contains a link to a CAPTCHA page. Some variants include an additional lure page hosted on a legitimate service such as Miro, Google Sites, or Zoom, which redirects the victim to the next step.

3. Finally, the victim is directed to a phishing page that instructs them to enter a device code on Microsoft’s legitimate authentication page, potentially granting the attacker access to their Microsoft 365 account.

The phishing page relies on obfuscated JavaScript functions and separate script files. Using ANY.RUN’s In-Browser Data Inspection, analysts can examine the page’s DOM and HTTP activity to understand how these scripts operate.

The scripts keep the page in regular contact with the PHP backend and determine the location of the victim from their IP address. Within the page DOM, the main script loads additional modules, sets click handlers on buttons and builds GET requests to the PHP endpoint /session_public.php with the action parameter (start or poll).

With action=start, the script sends the geolocation and IP address of the victim and receives a session ID. After that, it sends a request with action=poll every few seconds to check whether the victim has authenticated.

The other modules of the phishing page are listed below:

Module	Purpose
client_geo.js	Determines the location of the victim from the response of one of three services: ip-api[.]com, ipapi[.]co or ipwho[.]is. The location can also be obtained through the PHP endpoint php/endpoints/client_geo.php.
url_helper.js	Base script with helper wrappers for URL handling, such as building GET parameters and appending slashes.
endpoint.js	Tracks the state of the victim. It logs the e-mail address, password, browser, MFA status, country and other auxiliary fields used during authentication and sends them to the PHP backend at php/endpoints/accounts.php.

A single phishing URL can be the starting point for uncovering an entire campaign. In the SkyW4lker investigation, identifying the malicious page was only the beginning. Analysts needed to trace related activity, identify additional infrastructure, and determine how far the campaign extended. Traditionally, connecting these findings requires repeated IOC lookups, manual correlation, and searching through previous investigations.

ANY.RUN’s major new upgrade, Related Threat Context, makes this process significantly faster and easier. By bringing connections to previous sandbox investigations and threat intelligence directly into the Interactive Sandbox, it helps analysts discover related threats, reuse existing findings, and expand investigations with fewer manual steps.

With more than 700,000 security professionals and 16,000 organizations worldwide using ANY.RUN, analysts can draw on a vast pool of real-world investigation data to uncover connections that might otherwise take considerably longer to find.

During our SkyW4lker investigation, the new Related analyses section surfaced previous sandbox sessions sharing the same URL patterns. This gave analysts an immediate starting point for tracing related activity instead of manually searching for connections across individual investigations.

Using the distinctive PHP endpoint /session_public.php, we moved into ANY.RUN Threat Intelligence Lookup in a single click, discovered additional phishing activity, and expanded the campaign cluster.

The investigation demonstrates the practical value of Related Threat Context: less time spent searching for connections, faster discovery of related infrastructure, and more evidence available to guide the next investigation step.

Reduce Manual Triage and Strengthen SOC Investigations

The same approach can be applied to other suspicious URLs and indicators, allowing SOC teams to build on previous investigations and uncover related threat infrastructure faster.

Tier 1 analysts spend less time on repetitive IOC research, gaining more evidence to support accurate triage and escalation decisions. Tier 2 analysts receive richer investigation context, helping them focus on cases that genuinely require deeper analysis.

By connecting individual alerts to existing threat intelligence, Related Threat Context helps SOC teams shorten investigation cycles, reduce unnecessary manual work, and make better-informed response decisions.

Attribution: The Connection Between SkyW4lker and Gabagool

Each phishing page has its own backend, so the administration panel is likely to be hosted on the same domain. Further analysis of the Threat Intelligence Lookup results and data from other sources revealed an administration panel at /admin/index.php.

The CSS styles (command-center.css) suggest the following capabilities of the kit:

• Authentication with MFA via Telegram
• Dashboard with victim statistics based on the client_geo.js module
• Server management
• Generation of new links
• Live notifications about new visits to phishing links

Further investigation revealed another important finding: SkyW4lker shares several technical components with Gabagool, a credential phishing kit.

A search in ANY.RUN Threat Intelligence for the unique module paths of SkyW4lker url:”/js/client_geo.js” or url:”/js/url_helper.js” or url:”/js/endpoint.js”) also returns sandbox sessions tagged gabagool. Gabagool was first observed on 23 April 2026, two months before SkyW4lker, and has used the endpoint.js and url_helper.js modules since late April and early May. The two kits share several other features:

Feature	SkyW4lker	Gabagool
First seen	23 June 2026	23 April 2026
Analyses in six months	618	458
Shared JavaScript modules	client_geo.js, url_helper.js, endpoint.js (since July 2026)	client_geo.js, url_helper.js, endpoint.js (since late April 2026)
Visit endpoint	/assets/php/endpoints/confirm_visit.php	/assets/php/endpoints/confirm_visit.php
Self-hosted CAPTCHA	/assets/private_captcha/public/widget.js?v=4	/assets/private_captcha/public/widget.js?v=4
Landing token	zt[A-Za-z0-9]{32}op; it[A-Za-z0-9]{32}us from 10 August	zt[A-Za-z0-9]{32}op; it[A-Za-z0-9]{32}us from 5 August
Same directory on shared hosts	5200m[.]com/kvme2/ (16 Oct), torvion[.]life/ofulium/ (5 Oct), ghethim[.]com/hyllen/ (28 Sep – 2 Oct)	5200m[.]com/kvme2/ (15 Oct), torvion[.]life/ofulium/ (6 Oct), ghethim[.]com/hyllen/ (8 Oct)
Hosting	mostly DigitalOcean	mostly DigitalOcean; shared IP 172.86.85[.]51 (priorispace[.]biz)
Main endpoint	session_public.php (device-code phishing)	accounts.php (login and password harvesting)

Moreover, some sandbox sessions tagged gabagool load the kit from directories named skywalker:

goldcreekconcrete[.]com/example/skywalker/ (sandbox session) and goldcreekconcrete[.]com/skywalker/example/ (sandbox session). On goldcreekconcrete[.]org, which also hosted Gabagool (sandbox session), the directory /skyw4lker/skydirectory/ with the same modules appeared on 29 September (sandbox session).

We therefore assess with high confidence that Gabagool and SkyW4lker are built by the same developer. Gabagool harvests logins and passwords through accounts.php, whereas SkyW4lker abuses the device-code flow through session_public.php, so we regard them as two attack modes of one platform. The identical directories on shared hosts may also point to a common operator; however, the available data does not allow us to distinguish one operator from several customers of the same platform.

How to Detect SkyW4lker and Reduce Enterprise Exposure

The SkyW4lker investigation reveals several technical indicators and attack patterns that security teams can use to identify related phishing activity. For organizations, these findings also highlight opportunities to strengthen identity security and reduce the impact of potential account compromise.

For SOC Analysts and Threat Hunters

• Hunt for SkyW4lker’s technical fingerprints. Look for requests to /session_public.php?action=start and repeated /session_public.php?action=poll calls. Check the JavaScript modules and URL patterns identified in this research to uncover related infrastructure.

• Connect phishing activity with suspicious sign-ins. Monitor Microsoft Entra ID logs for unexpected device-code authentication, particularly following suspicious emails or document-sharing requests. Correlating authentication events with phishing indicators can help identify potential account compromise.

• Expand investigations beyond individual IOCs. ANY.RUN’s newly introduced Related Threat Context puts connected sandbox analyses at analysts’ fingertips, with a one-click pivot to threat intelligence context for deeper threat hunting. In the SkyW4lker investigation, this helped expand the campaign cluster, while further analysis revealed shared infrastructure and code similarities with Gabagool.

• Investigate potential follow-on activity. When account compromise is suspected, review subsequent Microsoft 365 activity to identify affected resources, unauthorized access, and possible attempts to target other users.

For CISOs and Security Leaders

SkyW4lker demonstrates why organizations need to look beyond traditional phishing prevention and MFA when evaluating identity security. Three priorities deserve attention:

• Close authentication policy gaps. Review where device-code authentication is genuinely required. Restrict or block unnecessary use through Microsoft Entra Conditional Access to reduce opportunities for attackers to abuse legitimate authentication flows.

• Strengthen detection across email and identity systems. Ensure the SOC can connect suspicious attachments, phishing infrastructure, and unusual authentication events. Better visibility across these stages helps teams identify potential compromises before attackers expand their access.

• Reduce investigation time and escalation costs. Equip Tier 1 analysts with historical threat context and clear escalation criteria. Establish procedures for containing compromised accounts and reviewing unauthorized activity, helping Tier 2 teams focus on incidents requiring deeper investigation.

Conclusion

SkyW4lker continues to evolve, with new endpoints, changing URL patterns, and growing activity across sandbox analyses. Its connection to Gabagool suggests that the same developer is supporting both device-code and credential phishing, giving attackers different ways to compromise business accounts through shared infrastructure.

For organizations, the findings highlight a broader security challenge: attackers are increasingly exploiting legitimate authentication processes and trusted business services, making malicious activity harder to distinguish from normal operations.

As phishing kits evolve, security teams need more than traditional email filtering and MFA. Stronger identity controls, visibility into suspicious authentication activity, and access to connected threat context can help SOCs identify attacks earlier, investigate them faster, and reduce the potential impact on business operations.

About ANY.RUN

ANY.RUN provides cybersecurity solutions that help SOC and MSSP teams detect and investigate threats, make faster decisions, and reduce the time and resources spent on incident response.

The company’s solutions include Interactive Sandbox for analyzing suspicious files, URLs, and phishing attack chains, and ANY.RUN Threat Intelligence with Threat Intelligence Lookup, Threat Intelligence Feeds, and Threat Intelligence Reports. Together, these solutions help security teams uncover related threat activity, track evolving attack infrastructure, and strengthen detection with intelligence from real-world investigations.

Today, ANY.RUN is trusted by more than 16,000 organizations and 700,000 security professionals worldwide. The company is SOC 2 Type II certified, with security controls designed to protect customer data.

TTPs (MITRE ATT&CK)

Tactic	Technique	Procedure
Reconnaissance	T1589.002 Gather Victim Identity Information: Email Addresses	The SkyW4lker operator collected recipient e-mail addresses to personalise phishing links using the landing-URL suffix ? or ?? after /it[A-Za-z0-9]{32}us.
Reconnaissance	T1590.005 Gather Victim Network Information: IP Addresses	The SkyW4lker phishing kit recorded the visitor's IP address, ISP, organisation and location to profile victims using client_geo.js and the request /assets/php/endpoints/session_public.php?action=start&ip=…&isp=…&org=…&org_type=.
Resource Development	T1583.001 Acquire Infrastructure: Domains	The SkyW4lker operator registered look-alike domains of real companies to host phishing pages using typo-squatted names under Microsoft-themed subdomain chains, e.g. sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com and pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com.
Resource Development	T1583.001 Acquire Infrastructure: Domains	The SkyW4lker operator obtained free dynamic-DNS subdomains to host phishing pages using flow505.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab[.]com.
Resource Development	T1583.003 Acquire Infrastructure: Virtual Private Server	The SkyW4lker operator rented virtual private servers to run the PHP backend using DigitalOcean hosting (50 of 92 backend IP addresses), e.g. 162.243.64[.]121 and 67.205.154[.]32.
Resource Development	T1608.005 Stage Capabilities: Link Target	The SkyW4lker operator staged intermediate pages to forward victims to the kit using public cloud buckets and site builders, e.g. pub-177b3aa5a54d4f9087a649de5ec766d5.r2[.]dev/docsonedrive2026.html, carcabaoperadologistca.fr-par-1.linodeobjects[.]com/document_excel.html and bethom-contracting-llc.mintlify[.]site.
Initial Access	T1566.001 Phishing: Spearphishing Attachment	The SkyW4lker operator sent password-protected attachments to deliver the phishing link using PDF, XLS, DOCX and EML lures named -protected.pdf or DOC <10 random characters>.pdf, e.g. SHA256 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268.
Initial Access	T1566.002 Phishing: Spearphishing Link	The SkyW4lker operator sent links hosted on legitimate services to pass e-mail reputation checks using Google Sites, Axure Cloud and Smartsheet pages and the maps.google[.]ie/url?q= redirect, e.g. sites.google[.]com/heatherrasekhomes.com/talbert-manufacturing-inc-0049/home.
Execution	T1204.001 User Execution: Malicious Link	The SkyW4lker phishing kit relied on the victim opening the landing link to start a phishing session using the path //it[A-Za-z0-9]{32}us.
Defense Evasion	T1656 Impersonation	The SkyW4lker operator imitated routine business correspondence to make the lures credible using subjects such as New Submission From , Approved Statement and Fedwire Funds Service Processed-()-.
Defense Evasion	T1497 Virtualization/Sandbox Evasion	The SkyW4lker phishing kit placed a CAPTCHA in front of the phishing page to hide it from automated scanners using Cloudflare Turnstile and the self-hosted /assets/private_captcha/public/widget.js?v=4 with /assets/php/endpoints/private_captcha_challenge.php.
Defense Evasion	T1027 Obfuscated Files or Information	The SkyW4lker phishing kit obfuscated its JavaScript to hinder analysis using obfuscator.io-style code (520 of 618 analyses carry the obfuscated-js tag).
Credential Access	T1528 Steal Application Access Token	The SkyW4lker phishing kit abused the Microsoft OAuth 2.0 device-code flow to obtain the victim's access tokens using login.microsoft[.]com/device and login.microsoftonline[.]com/common/oauth2/deviceauth while polling /assets/php/endpoints/session_public.php?action=poll&session_id=.
Collection	T1056.003 Input Capture: Web Portal Capture	The SkyW4lker phishing kit logged the victim's e-mail, password, browser, MFA status and country to collect credentials using endpoint.js and the backend php/endpoints/accounts.php.

IOCs

All indicators were observed in ANY.RUN analyses between 23 June and 21 October 2026.

URL patterns:

Pattern	Purpose	Seen
//it[A-Za-z0-9]{32}us	Landing page token; may end with ? or ??	2026-08-10 – 2026-10-19
//zt[A-Za-z0-9]{32}op	Earlier landing page token	2026-06-25 – 2026-09-28
/assets/php/endpoints/session_public.php?action=start&ip=&ip_address=&country=&country_code=&IP[ip]=&IP[country]=&city=…®ion=…&timezone=…&isp=…&org=…[&org_type=IPv4]	Session registration with visitor geolocation	2026-06-23 – 2026-10-21
/assets/php/endpoints/session_public.php?action=poll&session_id=	Polling of device-code authentication status	2026-06-23 – 2026-10-21
/assets/js/client_geo.js	Visitor geolocation module	2026-07-07 – 2026-10-19
/assets/js/endpoint.js	Session state and credential logging module	2026-07-22 – 2026-10-20
/assets/js/url_helper.js	URL helper module	2026-07 – 2026-10
/assets/php/endpoints/confirm_visit.php	Visit confirmation endpoint	2026-08-31 – 2026-10-15
/assets/private_captcha/public/widget.js?v=4, /assets/private_captcha/public/widget.css, /assets/php/endpoints/private_captcha_challenge.php	Self-hosted CAPTCHA gate	2026-07-07 – 2026-09-28
/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}.js	Brand-specific document script	2026-07-20 – 2026-10-20
(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth).*(outlook|onedrive|copilot|office365).*.	Microsoft-themed hostname chain on look-alike domains	2026-06 – 2026-10

Domains hosting the phishing kit (173):

0350pvas.acs-wcst[.]com

0ff365access.mooo[.]com

0utlook0ffice365admin.twilightparadox[.]com

1355bcra.ck29material[.]com

1717emxr.acs-wcst[.]com

5200m[.]com

5375jngu.prefform[.]us

6662nyde.acs-wcst[.]com

6695lkmo.prefform[.]us

7301eqny.acs-wcst[.]com

7criccasinobonus[.]cc

aachem-za[.]co

accordhealth[.]cc

acrobat-adobe-com-4464uswc.egllo[.]com

advancedsteelbuilding[.]com

alasilla[.]com

albertamo[.]com

alfabricationinc[.]com

apexpartsdepot[.]com

apinows[.]com

atlantictriad.ignorelist[.]com

atlassgroupinc[.]com

auth-loadingdocuments[.]online

auth.login.office365.cloud.onedrive.outlook.atlarchitacts[.]com

authorize.copilot.outlook.common.microsoft0365.atlarchitacts[.]com

awemode.outlookoffice365.microsoftcopilots.docshare.linnwest[.]us

azgymfloor[.]com

bandg-electrics[.]com

bennett002.mooo[.]com

bezpartien[.]online

bigbrain.chickenkiller[.]com

bloomfleldcapital[.]com

bramum[.]online

buckslu[.]org

bxcelcounselling[.]org

caine-wenier[.]com

calebchemicals[.]com

calmechc[.]net

canacedesotogroup[.]com

celestialtremor[.]org

celliottelliott-wellman[.]org

celvarioncorn[.]org

centipedtourspa[.]com

claronevents[.]com

cleggs.my03[.]com

clingard[.]pro

clubdenut[.]club

copilot.login.office365outlook.cloud.onedrive.atlarchitacts[.]com

copilots.outlook.cloud.microsoft.andersonelevators[.]com

copilots.outlook.cloud.microsoft.syrosconstructlon[.]com

coreansdmain[.]com

csr-rooflng[.]com

ctr-wooding[.]com

darap-it[.]co

detroitgardenswork[.]com

devtachsales[.]com

dguidrycardinazprofessional[.]com

docshare.auth.copilot.outlook.onedrive.common.earthlink-net[.]com

docshare.auth.copilot.outlook.onedrive.common.evergreenerg[.]com

docshare.auth.copilot.outlook.onedrive.common.northemheating[.]com

docshare.auth.copilot.outlook.onedrive.common0.evergreenerg[.]com

docshare.auth.copilot.outlookonedrive.common.northemheating[.]com

docshare.auth2026.onedrive.outlooksdocument.csr-rooflng[.]com

docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng[.]com

document.akiflx[.]com

dpincoli[.]com

dutchfarrms[.]com

eccentric-authentication[.]com

ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc[.]com

efaxdoc.auth.login.outlook.office365.tescoccontrols[.]com

efaxdoc.auth.outlook2026common.copilos26.bettylnc[.]com

efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr[.]com

efaxdoc.auth.outlook2026common.copilos26.kone-inc[.]com

efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc[.]com

efaxdoc.documents2026.docs.shared.lakeviewscustom[.]com

eurosforgroup[.]com

flow505.mooo[.]com

flow55.chickenkiller[.]com

fosterswifts[.]com

frontdesk[.]click

gcotoncovingtoncontracting[.]com

ghethim[.]com

glafondbottamconstruction[.]com

globlasumi[.]com

gregor.justdied[.]com

grincool[.]xyz

haevy-llc[.]com

hcnyecom[.]com

hivezoom[.]com

ideahom[.]world

incommecialre[.]com

innvisoin[.]net

insigthinvestments[.]com

investomind[.]biz

jacobpwpinc[.]org

jjnysnobiogtx[.]org

kilishy.qhigh[.]com

kuer[.]online

lampadasdeslgn[.]com

lawyer.cuztools[.]com

lifetimeroofsystem[.]net

linking.mefound[.]com

linogomes-pt[.]cc

lionheartsecurityservice[.]com

liyuda[.]com

login.microsoft365.outlook.copilotsoffice365.lntactpr[.]com

login.office365outlooks.microsoft.cloud-outlook.naregruop[.]com

m365cloud.login.outlook.office365.azgymfloor[.]com

maqaigiapelhani[.]cam

metlarnelaw[.]com

metrorocl.co[.]uk

mgproparties[.]com

minda-mo[.]com

mouphyweb[.]com

naregruop[.]com

nicewayrealestate[.]cc

noxband[.]com

off365acess.jumpingcrab[.]com

off365mail[.]club

office0365login.2waky[.]com

outlookdrive.microsoftonline.common.oauth2.client.buycerm[.]com

outlookoffice365.microsoftcopilots.vigilantlnc[.]com

paulecosconnect[.]com

payapp.auth.outlook2026common.copilos26.bettylnc[.]com

pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr[.]com

pdlhaelth[.]com

pdocshared.documents2026.docs.shared.ecmholdlnggroup[.]com

pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com

photosofus[.]com

plusoptlx[.]com

priorispace[.]biz

psionicsandhorses[.]net

rapid-scale[.]net

reauth.copilot.auth.outlook.mcloud365.buycerm[.]com

reauth.copilot.auth.outlook.mcloud365.myhalnc[.]com

reauth.copilot.common.outlook.mcloud365.atlarchitacts[.]com

reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras[.]com

rektham[.]online

rubinsrudman[.]com

rustlnsurance[.]com

sdocshares.auth.outlook.copilos26.general.csr-rooflng[.]com

sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com

sdocshares.authoutlooks.common.copilots2026.hathormson[.]com

seatacsmarine[.]com

sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer[.]com

shared.paymentsclouds.statementsapproved.jetbusinesscapltal[.]com

slybee[.]com

snk-s[.]org

solutions00fileptroduct[.]com

sorensenmaysflower[.]blog

statement.docdriveoauth.authorized.copilot.syrosconstructlon[.]com

statement.outlookoffice365.microsoftcopilots.calmechc[.]net

statements.outlook.office365microsoft.payment.run.stoneclty[.]com

stellarntis-fs[.]com

studeseliamechan[.]link

sunraycontractlng[.]com

sunstateaquips[.]com

swiftii.chickenkiller[.]com

tentkit[.]com

thepaybank[.]com

thewiginton[.]com

topcoatmetalsfinishing[.]com

toplinebuy[.]com

torvion[.]life

unitadrentals[.]com

unitedwirescompany[.]com

us-agricultures[.]com

vasquezmyth[.]com

westlakeproduces[.]com

whitfillsnursery[.]com

wsochares.authpayments.common.paid2026.bullochdirtwroks[.]com

wwriwashingtonenergy[.]com

zrs-wooding[.]com