Hi all.
I found a tweet by PhishingAI that discovered some scammers using freenom domains.
http://secure2387manage.ml
http://secure2387manage.tk
http://managercontrol21.ml
You can view more of the tweet here: https://twitter.com/PhishingAi/status/1028009459866451968?s=19