Spammer hosting located here:
https://ketoopufunxvkhsmrt.blob.core.windows.net/ketoopufunxvkhsmrt/1dqgqcalkdh.html
-> https://www.incorport.com/X
—> https://www.thehealthysavers.com/de-healthenews-v1/?sub1=X
—> https://clickandglory.com/click.track?CID=X
—-> https://theketobodytone.com/bodytone_int_v2/?lang=X
$ dig +short unsubscribepchar.blob.core.windows.net
blob.db6prdstr06a.store.core.windows.net.
52.169.240.64
Spam sample
====================================================================
Received: from Abrouhline.com (unknown [185.250.205.70])
by X (Postfix) with ESMTP id X
for <X>; Fri, 1 Jan 2021X
Date: Fri, 01 Jan 2021 X
From: «Keto BodyTone» <customer-service-@lixar.net>
Subject: Revolutionare Medizin zur Gewichtsreduktion
To: X
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=»UTF-8-Base64″
Message-Id: X
<center>
<a href=»https://unsubscribepchar.blob.core.windows.net/unsubscribelink/unsubscribelinksecured.html»> <br> Von der Mailingliste abbestellen </a>
<br><br>
<a href=»https://ketoopufunxvkhsmrt.blob.core.windows.net/ketoopufunxvkhsmrt/1dqgqcalkdh.html» target=»_blank»>
<img src=»https://ketoopufunxvkhsmrt.blob.core.windows.net/ketoopufunxvkhsmrt/2mqzkkapjev.png»>
</center>
<p style=»text-align: center;»><span style=»display:none;font-size:8px;»><span style=»color:#FFFFFF;»>
[…]
====================================================================