link → https://onedrive.live.com/view.aspx?resid=B856D3DC5F6DB0B6!146&authkey=!AJJrGTEIBbw0tvg
Clicking on View PDF takes you to https://athens-riviera.eu/rt/o365/
if you go to the main url https://athens-riviera.eu you will see this
here are some files i found on the website go to https://athens-riviera.eu/rt/ then you will be able to see a zip file
that contains the phishing code and stuff
cpanel:https://cpanel.athens-riviera.eu/
whois
Registrar:
Name: GoDaddy.com, LLC
Website: http://www.godaddy.com
Name servers:
ns75.domaincontrol.com
ns76.domaincontrol.com