Spammer hosting located here:
http://sefabningmo1973.blogspot.lt
-> http://webofin.xyz/de.html
—> http://vip.gupyjagu.xyz/tracker?offer_id=XXX
—> http://prl.gupyjagu.xyz/?pl=XXX
——> http://cabinet.dl.kryptogewinn.vip.gupyjagu.xyz/home
——> https://cabinet.kryptogewinn.com/html/masonFord.html?email=X&password=X
——-> https://www.masonford.com/auto-login/
$ dig +short sefabningmo1973.blogspot.lt
blogspot.l.googleusercontent.com.
172.217.168.33