From:                                                       OutIook DeIivery Notification <[email protected]>

Sent:                                                         Monday, May 25, 2020 12:16 PM

To:                                                            Recipient

Subject:                                                   Email Sending Erorr Report ID: 146578036

Outlook app

            Company Account-Service

You have {17} undelivered mails clustered on your cloud due to mail storage capacity is 99% full and awaiting approval from you to be delivered and restore access to info@company

We bring to your notice, this will make messages undeliverable. Fix this:

This may cause account disable if ignored. 

1. Release Undelivered messages to inbox

2. Clean up inbox

This email was sent to info@company.

Now the link actually points to: https://firebasestorage.googleapis.com/v0/b/owa-app.appspot.com/o/index.htm?alt=media&amp;token=58a7d598-3c12-431d-88e2-a05ed77d36d2#aW5mb0BzaXJjbGVzLm5ldA==

Which obviously has the encoded email address for future spam link building as well as secured the page against none recipients investigating whom it may belong to.

The link is then forwarded to: https://elcafetero.es/wp-filed/sink/ Which impersonates Outlook.com:

And if you type in a suitably offensive password three times, you see:

This was already flagged by Microsoft Edge (is this browser becoming the safest - it always seems to know the bad sites first.)

We have reported it to Google, especially as their appspot was part of the link.