Found this gem, forwarded to me today.
Link begins with the following domain:
virus-crash-i8m8yf.tech
The rest of the link can be seen in the screenshot I'm attaching.
Only things I blacked out was our IP address.
Quite glad our users are not falling for these lame attempts, but I'm making sure they are aware of these.