Redirecting to a PHISH or now being taken down?

See: https://urlquery.net/report/4b0f5409-c083-4ccb-8a17-270addaef6d1
and https://www.virustotal.com/gui/url/32736543a503df41b1ead3110b87beaead0a1fa80b70bfb4fd85c599d06e4909/details
and https://aw-snap.info/file-viewer/?protocol=secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=c3t8fV5ofXsjLl5sdWJgXmh9XW17YDx2PTUwMA%3D%3D~enc
and https://www.virustotal.com/gui/url/03e39e7df071cdf2e7c5a7ffd933afb30b5ad8ab3b471990d5b72b3ed65b4eeb/details
and https://www.virustotal.com/gui/ip-address/104.24.122.149/relations
and finally: https://www.virustotal.com/gui/url/968fb3959dd256a76daa8d7cb32f20699e59bd4d6041f644bc951153cbc628a9/detection
where the PHISHing from that IP was flagged.

polonus