2020.09.10 Still spamming
From: Margaret ❤️ <contact@beserk.com.au>
To: XXXXX
Subject: Re: Are you the man on my dreams PROGRAMS?
<a href=»http://reberson.v6.rocks/trans.php?xxxxxx»><font color=red><h1> The best singles you
can find for free at HelloDate!
2020.09.01 Moved from Amazon to Azure:
Date: Mon, 31 Aug 2020 23:26:31 +0200
From: Customer Service <contact@beserk.com.au>
Subject: Re: Congratulations ,PROGRAMS 🎁🎁
<a href=»http://reberson.v6.rocks/trans.php?t=c&d=xxxxxxxx»>
<font color=red><h1>
Stand a chance to win a $2000 Boating, Camping, Fishing voucher!
reberson.v6.rocks has address 52.230.21.217
——————————————————————————-
2020.08.27 And back on Amazon. *AGAIN*
Resolving reberson.v6.rocks (reberson.v6.rocks)… 18.191.207.29
2020.08.26 Kicked off Amazon Finally, our Free Psychopath Reading spammer moves to Hostwinds:
X-SMTP-IP: 13.69.139.163
X-SMTP-HELO: li35-83.members.linode.com
X-SMTP-RAWHELO: EHLO li35-83.members.linode.com
To: PROGRAMS
From: Medium Theresa ⚜️ <contact@beserk.com.au>
Subject: Re: PROGRAMS, you can put an end to your worries !
href=»http://reberson.v6.rocks/trans.php?
reberson.v6.rocks has address 104.168.247.119
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2020.08.20 new domain, still no response from Amazon.
ttp://reberson.v6.rocks/trans.php
Resolving reberson.v6.rocks (reberson.v6.rocks)… 18.218.195.57
Connecting to reberson.v6.rocks (reberson.v6.rocks)|18.218.195.57|:80… connected.
HTTP request sent, awaiting response… 200 OK
http://calams.ooguy.com/trans.php
2020.08.18 change of name, no response from Amazon.
http://avuri.crabdance.com/trans.php
avuri.crabdance.com has address 18.218.195.57
Possible alternatives:
—————————————————
18.218.195.57 fifikamlimos.host
18.218.195.57 herokunomo.site
18.218.195.57 www.genemotiona.space
18.218.195.57 genemotiona.space
18.218.195.57 avuri.crabdance.com
18.218.195.57 sezardnes.host
18.218.195.57 mail.sezardnes.host
18.218.195.57 www.hamouchinoba.space
18.218.195.57 hamouchinoba.space
18.218.195.57 honrika.gleeze.com
18.218.195.57 hanriko.gleeze.com
18.218.195.57 mail.konchibayn.icu
18.218.195.57 konchibayn.icu
18.218.195.57 handaloisia.space
18.218.195.57 hololoyanes.icu
—————————————————
2020.08.15 still being spamvertised,
Date: Sat, 15 Aug 2020 x +0200
To: PROGRAMS
From: William <contact@beserek.com.au>
X-SMTP-IP: 40.123.228.223
X-SMTP-HELO: li1266-67.members.linode.com
An all images spam pointing at:
http://honrika.gleeze.com/trans.php?t=c&d=x&l=x&c=x&ct=x-x&ur=x
Resolving honrika.gleeze.com (honrika.gleeze.com)… 18.218.195.57
Connecting to honrika.gleeze.com (honrika.gleeze.com)|18.218.195.57|:80… connected.
If «William» was really psychic, he would know that he just spammed a shell script.