These websites are known to have been using phonepaypluslimited054.sharepoint.com as their DNS nameserver.