Spammer hosting located here:
https://storage.googleapis.com/b8e5d7c64eab4dcea7b3/6e1352037146175b04be#cl/XXX
-> http://saletoyou.best/XXX
—> https://notorioushub.com/XXX
—> https://meetsap.com/?X
$ dig +short saletoyou.best
34.72.101.159
Spam sample
================================================
Received: from ug18.newmodels.xyz (unknown [46.148.238.57])
by X (Postfix) with ESMTP id X
for <X>; Tue, 15 Sep 2020 X
X-Received: by 2002:a37:6287:: with SMTP id X; Tue, 15 Sep 2020 X
Date: Tue, 15 Sep 2020 X
To: X
Subject: =?utf-8?B?RGFzIEVuZGUgZGVyIMOEcmEgZGVzIMOcYmVyZ2V3aWNodHMhIA==?=
From:»=?utf-8?B?R2VzdW5kaGVpdHMtTmV3cw==?= =?utf-8?B?8J+kmQ==?=» <1JMy@tpg.com.au>
MIME-Version: 1.0
Content-Type: text/html; charset=»ISO-8859-1
Message-ID: <X@notifications.google.com>
Envelope-To: <X>
<p style=»text-align: center;»><a href=»https://storage.googleapis.com/b8e5d7c64eab4dcea7b3/6e1352037146175b04be#cl/X»><img src=»https://storage.googleapis.com/40e7212f9f4630736608/eebfdad8bcbba6887d97″ alt=»» width=»712″ height=»899″ style=»display: block; margin-left: auto; margin-right: auto;» /></a></p>
<p>
================================================