Comment by wordule

Either they have an open redirect being misused, or their domains are being used to host phish content.

This is the way of things.