Info from email header :
Received: from mail.adje4-100.lg.honingbijen.com (mail.adje4-100.lg.honingbijen.com[185.100.91.95])
by mail.adje4-100.lg.honingbijen.com (Postfix) with ESMTP id 4CD6A4A256C
From: Blanche [email protected]
smtp.mailfrom=lg.aldaniti.net
header.d=lg.cammiletea.com
header.from=lg.cammiletea.com
Sender: [email protected]
There are a lot of links with domain lg.thesuperchance.com in the body :
http://lg.thesuperchance.com/6892/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxMSwiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/8922/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxMiwiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/1852/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxMywiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/8972/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxNCwiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/5145/eyJpZEMiOiIzNzIwIiwiaWQiOjE0NjM5NDY2LCJlIjoiaGFuczA3NzMwMTlAaG90bWFpbC5jb20iLCJsIjoibGlzdF9DTF9Ob3ZpZW1icmVfMjAxOSJ9
http://lg.thesuperchance.com/9342/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxNSwiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/8302/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxNiwiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/5032/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxNywiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/6752/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOjE0NjM5NDY2LCJjb2QiOjQ0MTMxNjcxOCwiY2F0IjoiMTA3Mzc0MTgyNCIsImNudCI6IkNITCIsImxpc3QiOiJsaXN0X0NMX05vdmllbWJyZV8yMDE5IiwiZW1haWwiOiJoYW5zMDc3MzAxOUBob3RtYWlsLmNvbSJ9
http://lg.thesuperchance.com/4462/eyJpZENsaSI6IjM3MjAiLCJpZENhbXAiOiIxNDYzOTQ2NiIsImNvZCI6NDQyNzQwMjY5LCJjYXQiOiIxMDczNzQxODI0IiwiY250IjoiQ0hMIiwibGlzdCI6Imxpc3RfQ0xfTm92aWVtYnJlXzIwMTkiLCJlbWFpbCI6ImhhbnMwNzczMDE5QGhvdG1haWwuY29tIn0
These domains above redirect to domain called www.blanchedesanandres.com, but if you try to visit lg.superchance.com only(without the long text above), it will redirect to dailymailz.nl
There is a link with visibility hidden in the email header :
http://lg.thesuperchance.com/7033/aHR0cDovL2xlYWRzZ2xvYmFsLmdvMmNsb3VkLm9yZy9hZmZfaT9vZmZlcl9pZD05MzEzJmFmZl9pZD0xODc2JmZpbGVfaWQ9NzEzOTQ. This link redirect to http://leadsglobal.go2cloud.org/aff_i?offer_id=9313&aff_id=1876&file_id=71394
Can you guys do something about all these domains?