Spammer hosting located here:
http://nyc.hiremedical.com/home/redirect/?site=//0xC227CF2A?MTk4NTk3MTg4PTQyOTk0JjM0MjU4MjU9MjY1JjE0Mz1jbGljayY3cm5ud2U9NiZsaWQ9NjA3Mw==
-> http://194.39.207.42/?X
—> https://www.loansidemed.com/2LMRW6M/LZBSWBW/?sub2=X
—> https://getnuubu.com/articles/uncovered-japanese/?l=X
$ dig +short getnuubu.com
172.67.194.231
104.21.12.141
Spam sample
========================================
Received: from forget.beginndend.com (forget.beginndend.com [27.255.79.190])
by X (Postfix) with ESMTP id X
for <X>; Sat, 22 Jan 2022 X
Received: from tpgau.xyz (unknown [74.63.254.136]) by X (Postfix) with ESMTP id X for <X>; Sat, 22 Jan 2022 X
MIME-Version: 1.0
Message-Id: <X.X.X.lB6@presentcharity.net>
From: NUUBU Detox <Mc395Rx@presentcharity.net>
Subject: Ein Geheimnis für Glück und Wohlbefinden
Reply-To: reply_to@presentcharity.net
To: X
Content-Type: text/html; charset=UTF-8
Date: Sat, 22 Jan 2022 X
<html><body>
<p style=»font-size:3px;»>Your VGYVZNWLSSPB Portal !</p>
<p style=»font-size:3px;»>received this mail in error or need You will be asked YNAOMBGHNKTJ Portal with the link below:</p>
<p style=»font-size:3px;»>username: X dfhd: X</p>
<center><br><a href=»http://nyc.hiremedical.com/home/redirect/?site=//0xC227CF2A?MTk4NTk3MTg4PTQyOTk0JjM0MjU4MjU9MjY1JjE0Mz1jbGljayY3cm5ud2U9NiZsaWQ9NjA3Mw==»><font SIZE=»6″ face=’Elephant’ color=»red» >70 % Rabatt auf Reinigungspads</font></p><br />
<img src=»https://cdn.substack.com/image/fetch/w_1100,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F03540d1d-ef8d-4a8f-8087-fbc8fc2b2668_614x1168.png»>
</a></center>
<p style=»font-size:3px;»>Please use the following one to change your fdhwhen logging in for the first time.</p>
<p style=»font-size:3px;»><a href=»http://[google.com]»>[google.com]</a></p>
<p style=»font-size:3px;»>time fghto access the If you have assistance please contact our support team.</p>
</body></html>
[…]
========================================