Spammer hosting located here:
https://storage.googleapis.com/ca3f15cc0563174d47a7/6411d211243d2cd9d4cb#cl/86024_md/10/61943/4545/289/4485
-> http://soni-social.com/
—> https://getverdure.com/0/2/4642/0963ed4173ec9b656ce88c955cfbec5d/10/86024_60/289_4485_61943_708115_md
—> https://internetlovin.com/index2.php?id=79&s1=350221&s2=558447307&s3=1534&p=de2diet8a
—-> https://bbstairs.com/?028747d09e1dbbc22d86cc9885fdd37b
$ dig +short storage.googleapis.com
172.217.168.16
216.58.215.240
172.217.168.80
172.217.168.48
Spam sample
====================================================================
Received: from webdesignwessel.nl (ip91.ip-51-81-233.us [51.81.233.91])
by X (Postfix) with ESMTP id X
for <X>; Mon, 3 May 2021 X
MIME-Version: 1.0
Message-Id: <X@presentcharity.net>
From: =?utf-8?B?S2V0by1EacOkdCB1bmQgR2V3aWNodHN2ZXJsdXN0?= <NrMTyqn@presentcharity.net>
Subject: =?utf-8?B?VmVybGllcmVuIFNpZSBiaXMgenUgMTQga2cgaW4gZWluZW0gTW9uYXQsIG9obmUgU3BvcnTDvGJ1bmdlbiAhIQ==?=
Reply-To: reply_to@presentcharity.net
To: X
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=UTF-8
Date: Mon, 03 May 2021 X
<html>
<head>
<meta http-equiv=»Content-Type» content=»text/html; charset=utf-8″ />
<title></title>
</head>
<body>
<center style=»font-family:’Segoe UI'»><br/>
<a href=»https://storage.googleapis.com/ca3f15cc0563174d47a7/6411d211243d2cd9d4cb#cl/86024_md/10/61943/4545/289/4485″ style=»color:#EE0000″>
[…]
====================================================================