Snagged what looks like attempted phish/CSRF
Portrayed itself as a secure banking message. Initial hyperlink directed to
petroleuminvestigations[.]com
Looks like a VPS with openresty doing some lua-based filtering. Then user's kicked to an AWS address impersonating finance documents, and cookies are pulled in from bin.dreatrithoo[.]online common across finance scam sites today per LookyLoo.
34 more domains associated by MX IP address. CSV for all 36: