This has nothing to do with amp, and everything to do with users thinking http://printer001.cpalawyer.bz/mircosoftoneline.acutallogind... is a legit office 365 login page.

Not that they're going to notice that the url bar says something random anyways.