Spammer hosting located here:
http://happyviernes.duckdns.org/r.php?t=X
-> https://aptrk8.com/?a=X
—> http://go.tracknetframework.com/aff_c?offer_id=X
—> https://zozo-framework.com/Bitcoin-DE/?transaction_id=X
——> https://connectologic.sendlane.com/form/23909
——> https://uprofx.io/?token=X
$ dig +short uprofx.io
35.190.28.119
Spam sample
================================
Received: from cdqz.marbouha.club (static.190.183.216.95.clients.your-server.de [95.216.183.190])
by X (Postfix) with ESMTP id X
for <X>; Sun, 13 Oct 2019 X
MIME-Version: 1.0
From: Bitcoin Code <from@marbouha.club>
Subject: X RIESIGE Gelegenheit, die ich mit dir teilen will!
Reply-To: reply@marbouha.club
Received: from marbouha.club (95.216.183.190) by marbouha.club id X for <X>; Sun, 13 Oct 2019 X(envelope-from <return@marbouha.club>
To: X
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=»UTF-8″
Date: Sun, 13 Oct 2019 X
Message-Id: <X.X@X>
<body style=»-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; background: white; font-family: ‘Arial’, ‘Helvetica’, sans-serif; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; width: 100%;»>
<table bgcolor=»#ffffff» width=»100%» cellspacing=»0″ cellpadding=»0″ border=»0″ class=»table-body» style=»line-height: 100%; margin: 0; padding: 0; width: 100%;»>
<tr>
<a href=’http://happyviernes.duckdns.org/r.php?t=X’><h1>Reite auf der Bitcoin Bitcoin Welle und verdiene garantier</h1><br><br>
<td align=»center» style=»border-collapse: collapse;» background=»https://s3-eu-central-1.amazonaws.com/igamingcloudstr/images/bctr-bg.jpg»>
<table width=»600″ cellspacing=»0″ cellpadding=»0″ border=»0″ align=»center» class=»content-table»>
<tr>
<td height=»10″ class=»page-break» bgcolor=»#ffffff» style=»border-collapse: collapse; line-height: 10px; mso-line-height-rule: exactly;»>
<br style=»visibility: hidden;»>
[…]
================================