Spam Campaign Analysis: Infrastructure Overlapping Security Scanning Platforms
A high-volume spam/phishing campaign targeting users with bad or no credit is actively abusing networks of compromised and throwaway domains. The operation uses PHP redirectors (r*.php scripts with encoded tracking parameters) to deliver loan and credit card lures, notably impersonating the legitimate Milestone Mastercard product.
Notable finding: Multiple domains in the campaign share infrastructure patterns with or pivot through nodes associated with internet-wide security scanning services (e.g., LeakIX). This highlights how actors leverage research-oriented mail and web infrastructure for better deliverability and resilience.
Campaign Details
Date observed: Mid-July 2026 (peak activity ~July 16).
Lures: Bad credit personal loans (“$100 – $40,000 decision in under 2 minutes”) and Milestone Mastercard offers (“$700–$1,000 credit limit”, “Apply Today”).
Tactics: Spoofed senders, multi-hop redirects, “click here to unsubscribe” links that also track, and occasional .docx/.pptx attachments.
Volume: High — domains showed 2–4 hits each in captured logs.
Technical Indicators
Redirector Pattern
Attackers use short-lived domains hosting PHP scripts such as:
/r62af.php?32=1o136a...e6jbv4z.T019krff...
/ra005.php, /re3d3.php, /r0bc9.php, etc.
These scripts handle click tracking (affiliate payouts), user-agent/referrer filtering, and redirection to final application pages.
Key Domains & Activity (from captured logs)
High-count domains (4 hits): bn.tarabuh.com, yh.isafund.com, tg.hilldew.com, rt.whXXXXXXX.com, op.ss2526.com, tk.trudiannetemple.com.
3-hit domains (partial): dk.corporatekits.in, dx.youXXXXXX.com, rt.serviciosparalaempresa.com, m.whittonavenue.net, yi.chinainformationagency.com, df.juhah.com, kr.utahmec.org, lt.domain404.com, pj.karentopakian.com, w.globalfilminc.com, pn.onlineextreme.com, cf.overstudio.net, mk.topbusinesschoice.com, vx.myvalueitems.com, gw.cherylbermeo.com, lf.kemicalkidd.com, wp.rheumatoidarthritisdiet.com, pq.bestchimneyandroofing.com, ze.thedriversagent.com, mp.advansisnetworks.com, nb.assandfacials.com, dv.printablecoloringsheets.net, ct.webcoves.net, nj.travelbiz.us, vy.friesian.us, iu.canadianfriendsoftheidf.org, h.louisvillepropellerclub.com, wi.senarova.com, er.dog-trainer-secrets.com, gh.hostpicz.com, cf.naqshgallery.com, ze.cassarcooper.net, yu.fitsthebudget.com, op.bamboobedden.com, yt.thenagynest.com, er.passovergoods.net, sd.endless-greece.com, t.bidsfly.com, ed.grungiest.com, ok.mortgagetraders.net, bv.elisemae.com, tr.vascoliveira.com, obihann.com
(notable recon overlap).
Example Message Excerpts
“LENDING For Bad Credit Borrow money when you need it. Get My Quote
$100 - $40,000 with a decision in under 2 minutes!”
“Applying is Easy $1000 Credit Limit* … Apply Today ▶ indigo”
Infrastructure Overlap & Server Data
Multiple domains align with the 78.46.102.241 cluster (mx01.mgmt.leakix.net). Nmap on this IP showed:
Open ports: 22 (OpenSSH 10.0p2 Debian), 80/443 (Golang net/http).
OS guesses: Linux 4.x–6.x, MikroTik, etc.
Uptime ~33 days.
Related scans:
89.58.57.239 (sfui): Nginx 1.18.0 on 80/443, Linux kernel guesses, uptime ~39 days.
45.33.65.164 (Linode): Nginx on 80/443.
Reverse IP Tracking Data:
mail.bio-honig-brunn.at, mail.dekantiert.de, leakix.net, mx01.mgmt.leakix.net, mail.vinarium.net, frontend02.de.he.nobody.run all resolve to or share the 78.46.102.241 infrastructure.
Data Flow
Email → Redirector domain (PHP) → Final landing (credit application form) → Potential lead exfil / affiliate backend.
Recommendations For Defenders / Individuals
Block the full domain list and tracking patterns (r[0-9a-f]*.php, specific encoded strings).
Verify all unsolicited credit offers directly with the issuer.
Use strong email filters and report to your provider.
For Researchers & Organizations
Monitor for new domains in this family (common naming and redirector patterns).
Report clusters to hosting providers, CISA, FBI, IC3 and brand owners (Mastercard/Concora).
Public scanning platforms should review mail server abuse potential.
IOCs (partial) Domains:
bn.tarabuh.com (4), yh.isafund.com (4), tg.hilldew.com (4), rt.whaXXXXXX.com (4), op.ss2526.com (4), tk.trudiannetemple.com (4), obihann.com (3), and dozens more.
URL Patterns: http://*/r*.php?32=1o136a*
IPs/Servers: 78.46.102.241 (main mail/redirect cluster with associated mail.* domains), 89.58.57.239, 45.33.65.164.
Conclusion
This campaign demonstrates the ongoing abuse of shared and research-adjacent infrastructure by spam operators. Continuous mapping and rapid sharing of IOCs remain critical. Quantitative Security continues to track these TTPs to support defensive operations and federal partners.
