Spammer hosting located here:
https://objectstorage.us-ashburn-1.oraclecloud.com/n/idqyn1owx1ll/b/njfrbizzgausse/o/1FRdqgqcalkdh.html
-> https://www.hasadom2.com/X
-> https://securedns.site/LtmVNo?aid=X
—> https://only-promotion.com/41/mcgausse-m-med/gps/?X
$ dig +short securedns.site
104.21.85.240
172.67.212.137
Spam sample
====================================================================
Received: from presentcharity.net (presentcharity.net [91.211.250.153])
by X (Postfix) with ESMTP id X
for <X>; Mon, 3 May 2021 X
DKIM-Signature: X
DomainKey-Signature: X
MIME-Version: 1.0
Message-Id: <X@presentcharity.net>
From: =?UTF-8?B?Q2VudHJlIGRlIEx1dHRlIGNvbnRyZSBsYSBEb3VsZXVy?=<NKPbwYv@presentcharity.net>
Subject: =?UTF-8?B?TGEgbWVpbGxldXJlIHNvbHV0aW9uIHBvdXIgbGVzIGRvdWxldXJzIGFydGljdWxhaXJlcywgbXVzY3VsYWlyZXMgZXQgdmVydMOpYnJhbGVz?=
Reply-To: reply_to@presentcharity.net
To: X
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=UTF-8
Date: Mon, 03 May 2021 X
<center>
<a href=’https://objectstorage.us-ashburn-1.oraclecloud.com/n/idqyn1owx1ll/b/njfrbizzgausse/o/1FRdqgqcalkdh.html’ style=’outline:none’ tabindex=’-1′ target=’_blank’>
<img src=’https://objectstorage.us-ashburn-1.oraclecloud.com/n/idqyn1owx1ll/b/njfrbizzgausse/o/2FRmqzkkapjev.png’/></a>
<a href=»https://objectstorage.us-ashburn-1.oraclecloud.com/n/idqyn1owx1ll/b/njfrbizzgausse/o/3xwonutaqbw.html»> <br> <br> Click here to unsubscribe </a>
</center>
[…]
====================================================================