The Phishing Link That Started at Google.com and Ended at a Fake Disney+ Login

A phishing email used a Google redirect wrapper, an is.gd short link, and an Azure Front Door subdomain to serve a Disney+-branded credential-harvest page, deliberately laundering trust through widely trusted infrastructure so reputation-only URL filters never reached the malicious terminal host; IRONSCALES expanded the full redirect chain, identified the credential-harvest page, and provides IOCs and mitigation guidance.