A number of IP addresses at Microsoft Azure are sending snowshoe spam that appear to be fake account confirmations, which are usually phish. This appears to be a survey page supposedly on behalf of US membership bulk retailer Sam’s Club. We doubt that it is actually run or authorized by Sam’s Club.
Whether the page is fraudulent, and therefore dangerous to users, or just spammed, this is NOT ACCEPtABLE to Spamhaus!
SENDING IPs:
13.65.185.68
13.77.215.23
20.194.41.32
20.37.241.154
20.46.112.77
20.49.23.151
23.100.94.31
23.97.51.34
40.113.17.88
40.123.218.61
40.123.250.16
40.127.87.128
40.74.119.234
40.78.49.118
40.86.99.252
40.87.109.89
51.103.129.181
51.116.113.65
51.140.45.241
51.141.114.135
51.145.242.200
52.143.111.105
52.147.15.0
52.229.114.62
65.52.204.64
104.211.88.61
191.235.83.164
SPAM SAMPLE:
Received: from raey.fun (raey.fun [20.37.241.154])
Date: Sat, 29 Aug 2020 18:##:## +0200
From: Customer service <<x>@raey.fun>
Subject: // Confirmation needed
<snip>
Sam’s Club
2019 Shopper Survey
Congratulations! You have been selectedto get an exclusive reward up to $100
To qualify for this special offer, simply complete our 30-second marketing survey about your experienceswith Sam’s Club and choose your reward.
[ Take the Survey ]
<snip>
URI: https://storage.googleapis.com/<x>
Redirects to => https://lorman.xyz/