Phish = htxp://nextinsurance.com.br//wp-content/themes/ecobiz/functions/ui/webmail/Buckeye-Express/bex.net/buckeye-express.html (thanks goes out for the heads-up to this one by our forum friend Pondus)
Online scanners give the site as clean. Location line conditional redirect found. Has jquery/ui/jquery.ui.datepicker.min.js?ver≈ 1.8.20’ code which seems benign…
polonus