Spammer hosting located here:
https://vchvgycfxfg.page.link/9cr1
-> https://www.metacanal.com/GZZFW4R/QXFHQWW/
—> http://thehealthysavers.com/lions-me-thoraxin/?sub1=X
—> https://thoraxin.net/?oid=X
$ dig +short thoraxin.net
104.18.50.86
104.18.51.86
172.67.204.193
Spam sample
======================================
Received: from aws.amazon.de (unknown [185.32.126.222])
by X (Postfix) with ESMTP
for <X>; Thu, 24 Dec 2020 X
MIME-Version: 1.0
From: =?UTF-8?B?VGhvcmF4aW4=?= <chello.at>
Subject: =?UTF-8?B?IEVuZGxpY2gga/ZubmVuIFNpZSBGZXR0IHZlcmxpZXJlbiwgVGVzdG9zdGVyb24gdW5kIGRlbiBTZXh1YWx0cmllYiBzdGVpZ2Vybi4=?=
Reply-To:
Received:
To: X
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=»UTF-8″
Date: Wed, 23 Dec 2020 X
<HTML><HEAD></HEAD>
<BODY>
<P align=center><FONT size=5><A href=» https://vchvgycfxfg.page.link/9cr1 «>Bitte klicken Sie hier, um die Webversion zu sehen #Thoraxinvorzustellen.
<P align=center><A href=» https://vchvgycfxfg.page.link/9cr1 «><IMG » src=»https://i.imgur.com/sANA4C4.jpg» ></A></P>
<SCRIPT>
UrIIkt UKqi dDe Pt wkYNaUKqiUKqi dDe UKqi dDe Pt wkYNa wkYNa UrIIkt
UrIIkt UKqi dDe Pt wkYNaUKqiUKqi dDe Pt wkYNa dDe Pt wkYNa wkYNa UrIIkt UKqi dDe Pt wkYNaPt
UrIIkt UKqi dDe Pt wkYNaUKqiUKqi dDe UKqi dDe
Pt wkYNaUKqi dDe Pt wkYNa wkYNa UrIIkt UKqi dDe Pt wkYNaPt wkYNa dDe Pt
</SCRIPT>
</BODY></HTML>