Scam Detective
Domain

tracking_url

First seen Feb 23, 2026

Suspicious
  • No SSL certificate
  • 2 community reports from users

Campaign Intelligence

This cluster centers on 2451 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include cdn.discordapp.com, 91.92.241.152, 91.92.240.222, 158.94.208.174, 178.16.52.44, 158.94.211.102, 158.94.210.93, 158.94.208.52, i.postimg.cc, s3.us-east-2.amazonaws.com, storage.googleapis.com, 178.16.52.18, 158.94.211.101, 158.94.211.100, local-host.life, dropmefiles.com, limewire.com, 62.60.226.159, id8965.com, valfanto.com and 2431 more. 633 of these domains have been flagged by threat int...

Part of: Debt Reduction Robocall Campaign4/22/2026

This cluster centers on 1486 connected domains tagged as AgentTesla, None, js. The domains include i.postimg.cc, cdn.discordapp.com, s3.us-east-2.amazonaws.com, pastes.io, dl.dropboxusercontent.com, ltcexchange.bitparking.com, bitcoin.sipa.be, litecoinpool.org, cryptocoincharts.com, sigaintevyh2rzvw.onion, toremail.net, lelantos.org, www.sigaint.org, epjhlyfgxenf2q4o.onion~~, inocncymyac2mufx.onion, torbox3uiot6wchz.onion, 344c6kbnjnljjzlz.onion, mailtor.net, bscscan.com, securitized.io and 1466...

Part of: No Subject Provided Robocall Campaign4/22/2026

This cluster centers on 2957 connected domains tagged as GuLoader, NorthKorea, censys. The domains include salelegalsteroids.com, 192.210.186.208, gharnt.com, cloflart.com, id3702579photo-image-docs.com, www.almacensantangel.com, 64.95.12.162, blue-oceans.net, sixmexicos.com, baritonclick.online, 185.252.24.15, un1rw11q4u.com, ameyiando.com, niril.sbs, bursaelektriktamir.com, blankeyeo.com, umxtxhub.za.com, sunchernical.com, 18.194.67.137, servecdn.my and 2937 more. 606 of these domains have bee...

Part of: Dropped call or no message Robocall Campaign4/22/2026

This cluster centers on 2107 connected domains tagged as GuLoader, NorthKorea, censys. The domains include storage.googleapis.com, cdn.discordapp.com, pastes.io, s3.us-east-2.amazonaws.com, dl.dropboxusercontent.com, 188.137.230.45, touchskins.io, 158.94.208.7, 74.0.32.149, 74.0.32.141, api.touchskins.io, 80.89.237.190, 188.137.254.207, api.wewpwsw.su, 188.137.229.136, 196.251.107.24, 104.194.152.180, link.storjshare.io, s3.g.s4.mega.io, 62.60.226.159 and 2087 more. 562 of these domains have bee...

Part of: Dropped call or no message Robocall Campaign4/22/2026

This cluster centers on 2121 connected domains tagged as GuLoader, NorthKorea, censys. The domains include 59.182.90.199, 178.50.166.61, 113.168.249.76, 123.209.193.86, 113.165.6.38, 120.157.72.234, 171.235.194.253, 120.157.159.171, 37.142.77.163, 46.124.33.133, 46.124.40.3, 83.224.151.243, 88.86.246.233, 41.146.1.154, 59.182.119.128, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, cdn.discordapp.com and 2101 more. 576 of these domains have been flagged by threat intelligence feed...

Part of: Lotteries, prizes & sweepstakes Robocall Campaign4/22/2026

This cluster centers on 1630 connected domains tagged as BABADEDA, pw-2026, wsh. The domains include storage.googleapis.com, cdn.discordapp.com, implementing-theft-metal-justin.trycloudflare.com, staying-heavily-meaning-blowing.trycloudflare.com, creations-venture-traditional-stainless.trycloudflare.com, arilprivate.storexyz.web.id, 206.123.145.26, 103.125.219.204, 45.87.43.154, 10cricofficial.com, justwatch.life, 195.16.44.75, advise-visual-playstation-closer.trycloudflare.com, 91.92.241.197, 6...

Part of: Medical & prescriptions Robocall Campaign4/22/2026

This cluster centers on 2141 connected domains tagged as GuLoader, NorthKorea, censys. The domains include 59.182.90.199, 91.80.129.100, 123.28.175.23, 120.61.247.2, 178.50.166.61, 113.168.249.76, 123.209.193.86, 113.165.6.38, 120.157.72.234, 171.235.194.253, 120.157.159.171, 37.142.77.163, 171.241.208.124, 120.157.229.220, 171.117.30.233, 91.80.136.9, 46.124.33.133, 46.124.40.3, 83.224.151.243, 88.86.246.233 and 2121 more. 596 of these domains have been flagged by threat intelligence feeds incl...

Part of: Lotteries, prizes & sweepstakes Robocall Campaign4/22/2026

This cluster centers on 2559 connected domains tagged as GuLoader, NorthKorea, trojan. The domains include 83.224.148.34, 14.236.247.68, 120.157.72.59, 95.127.248.192, 116.110.179.199, 116.101.73.68, 95.127.250.241, 152.173.199.182, 91.80.129.100, 59.88.45.188, 117.216.5.20, 182.60.11.164, 41.146.14.165, 120.157.46.38, 59.182.90.199, 113.168.249.76, 78.132.114.25, 171.241.208.124, 120.157.229.220, 14.236.84.25 and 2539 more. 640 of these domains have been flagged by threat intelligence feeds inc...

Part of: Archive Scam — lun.marvek.live4/22/2026

Details

First Seen
2/23/2026

Related Domains

domain

www.emailprivacytester.com

reported togetherdomain

emailprivacytester.com

reported togetherdomain

cve.mitre.org

reported togethercompany

ACCESS GROUP INC.

reported togetherphone

8553572202

campaign co-memberphone

3186669555

campaign co-memberphone

8667715844

campaign co-memberphone

8339086865

campaign co-memberphone

8009220204

campaign co-memberphone

4097617631

campaign co-memberphone

6789998212

campaign co-memberphone

6512042449

campaign co-memberphone

5187704680

campaign co-memberphone

8887291403

campaign co-memberphone

8889194623

campaign co-memberphone

9805107108

campaign co-memberphone

7712473445

campaign co-memberphone

5858247925

campaign co-memberphone

8009993355

campaign co-memberphone

8007715361

campaign co-memberphone

8009033637

campaign co-memberphone

8884260179

campaign co-memberphone

2025582508

campaign co-memberphone

9297499563

campaign co-member

Community Reports

[CVE# refused] Vulnerability in Apache Spamassassin discloses to remote attackers victim's ISP & email access times Disclosure vulnerability in Apache Spamassassin (default configuration) enables remote attackers to surreptitiously trigger Spamassassin to perform a DNS lookup that reveals to the attacker the IP address of the recipient's DNS server. The disclosed DNS server enables attackers to: * discover that the email address is actively attended to * potentially identify the ISP of the recipient * potentially acquire approximate location of the recipient (country, state, city) * potentially discover the time the email was read (and thus discover the schedule habits for when a recipient is at home or at work) * discover which DNS server to attack for DNS poisoning attempts Discovery of this vulnerability was facilitated by using emailprivacytester.com, which reveals a positive for this test: https://www.emailprivacytester.com/testDescription?test=dnsLink when a message is sent to a SA-processed inbox. CWE-1006 may be applicable here, as it's a detrimental coding practice to release software with a default configuration that is overly loose in terms of security. In particular, the behavior of Spamassassin fails the [principle of least astonishment](https://en.wikipedia.org/wiki/Principle_of_least_astonishment). Users would not expect the use of Spamassassin to reveal sensitive information to malicious actors as a consequence of static analysis of an email message. It is therefore an astonishing behavior resulting from bad coding practices. The Apache S/W Foundation is aware of the vulnerability and they do not consider it a bug. They will not harden the default configuration and unwitting users will continue to be exposed. # [VulnerabilityType Other] CWE-202, CWE-213, CWE-435. Possibly CWE-1006 and CWE-1076 as well. # [Vendor of Product] Apache # [Affected Product Code Base] Spamassassin - 3.4.2 # [Affected Component] Spamassassin rules: URIBL_SBL, URIBL

2608 days ago

[CVE# refused] Vulnerability in Apache Spamassassin discloses to remote attackers victim's ISP & email access times Disclosure vulnerability in Apache Spamassassin (default configuration) enables remote attackers to surreptitiously trigger Spamassassin to perform a DNS lookup that reveals to the attacker the IP address of the recipient's DNS server. The disclosed DNS server enables attackers to: * discover that the email address is actively attended to * potentially identify the ISP of the recipient * potentially acquire approximate location of the recipient (country, state, city) * potentially discover the time the email was read (and thus discover the schedule habits for when a recipient is at home or at work) * discover which DNS server to attack for DNS poisoning attempts Discovery of this vulnerability was facilitated by using emailprivacytester.com, which reveals a positive for this test: https://www.emailprivacytester.com/testDescription?test=dnsLink when a message is sent to a SA-processed inbox. CWE-1006 may be applicable here, as it's a detrimental coding practice to release software with a default configuration that is overly loose in terms of security. In particular, the behavior of Spamassassin fails the [principle of least astonishment](https://en.wikipedia.org/wiki/Principle_of_least_astonishment). Users would not expect the use of Spamassassin to reveal sensitive information to malicious actors as a consequence of static analysis of an email message. It is therefore an astonishing behavior resulting from bad coding practices. The Apache S/W Foundation is aware of the vulnerability and they do not consider it a bug. They will not harden the default configuration and unwitting users will continue to be exposed. # [VulnerabilityType Other] CWE-202, CWE-213, CWE-435. Possibly CWE-1006 and CWE-1076 as well. # [Vendor of Product] Apache # [Affected Product Code Base] Spamassassin - 3.4.2 # [Affected Component] Spamassassin rules: URIBL_SBL, URIBL

2608 days ago

Share Your Experience

What's Your Exposure?

Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.