Here's one I missed, good old Cloudflare has another wonderful service to look out for - Cloudflare R2 Object Storage. I've been seeing malicious URLs in emails using this service. URLs to watch out for contain r2[.]dev in them.
Google says this about Cloudflare R2, “Store large amounts of unstructured data without costly egress bandwidth fees.” Which I think really translates to, ‘Host your nasty malware/phishing stuff on the cheap.’