@neurovagrant You appealed to my boredom and I couldn't resist 😅

I'm not familiar with the earlier stages, but that bin.dreatrithoo[.]online page is a Tycoon 2fa phishing-as-a-service page. Same with those 'Finquick' and 'Flowguide' pages in your results. Tons of 'em out there. Easily the biggest phishing platform out there. Plenty of pivoting potential.