Microsoftyycc1 the first url that started the incident was fourthmanservice.com which indeed is marked as malicious from many engines.
Then another site was added. http://www.e-tsekouras.gr which has an issue with http link which misses a certificate and doesn’t auto redirect in https which is working.
another website added in the incident was koufomata.gr which I haven’t investigated yet but it’s a legit site.
then a fourth site was added http://www.athanassopoulos.gr. All these don’t connect with each other. All were accessed from different users.
More sites are added daily
