Фишинговые страницы, доставляемые через обновление заголовка HTTP-ответа

Исследователи Palo Alto Networks отмечают рост числа фишинговых кампаний, использующих уникальную технику, связанную с обновлением записи в заголовке HTTP-ответа. С мая по июль 2024 года ежедневно обнаруживалось около 2 000 вредоносных URL-адресов.

Эти атаки распространяют вредоносные URL-адреса через электронные письма, преимущественно нацеленные на мировой финансовый сектор, правительственные учреждения и крупные интернет-порталы. В отличие от традиционной тактики фишинга, основанной на HTML-контенте, этот метод использует заголовок ответа для автоматического обновления или перезагрузки веб-страницы, маскируя вредоносное поведение.

Злоумышленники часто используют взломанные или легитимные домены, что затрудняет обнаружение фишинговых ссылок. Вставляя в эти ссылки адреса электронной почты жертв и предварительно заполняя поддельные страницы входа, злоумышленники повышают доверие к своим кампаниям и увеличивают шансы на кражу учетных данных. Исследователи утверждают, что этот подход подчеркивает растущую изощренность фишинговых атак и необходимость создания бдительных механизмов обнаружения.

Indicators of Compromise

URLs

• [random previx].go.link/?c=se&s=l&vt=shop&adjust_t=j3uz6z_5ij79t&adjust_campaign=crm_bra_mix_gro_ma_%7B%7Bcampaign.$%7Bname%7D%7D%7D_%7B%7Bcampaign.$%7Bapi_id%7D%7D%7D_ct-VerticalsTrial&adjust_deeplink=onlinepizza%3A%2F%2F%3Fc%3Dse%26s%3Dl%26vt%3Dshop&adjust_redirect=https://everychildeducationmatters.com//readme/admin/[base64 text]/[base64 text]&adjust_reftag=[base64 text]&adjust_t=5ij79t&adjust_iredirect=https%3A%2F%2Feverychildeducationmatters.com%2F%2Freadme%2Fadmin%2F[base64 text]%2F[base64 text]&adjust_notrack=1
• edreams.onelink.me/p425?pid=CRM&af_adset=email&af_ad=crm_nl_X_NDR_INT_&is_retargeting=true&af_dp=ed-app://launch?utm_content=Appdynamic&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-REC-FL-X-XX_Notdreaming_INTERNATIONAL_Recovery_DL&mktportal=NL&af_web_dp=https://quetzalcitygt.com/css/1gmkfwcwxb/[base64 string]
• go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature&af_web_dp=https://brandqube-uae.com/lr/lrl2wt/[base64 string]
• guide-orientation.tn/go_page.php?href=https://4cut.pl//fancybox/top/[base64 string]
• guide-orientation.tn/go_page.php?href=https://atmmahmud.com/kgh/[username]/[targeted email address]
• guide-orientation.tn/go_page.php?href=https://fe.xrqo8.ru.com/.well-known/acme-challenge/[base64 string]
• http://14149-8963-8963.marksconstruction.space/home/8963/8963/8963/[targeted email address]
• http://babasturizm.com/costin/nymb/coartst/aouth/[base64 string]
• http://beautyandbait.com/re/xc0017xc0017/[base64 string]
• http://circuitovtr.com.br/dayo/[random string]/captcha/[base64 string]
• http://claimmysurplusfunds.com/claimmysurplusfunds/claimmysurplusfunds/[base64 string]
• http://cryptochronicles.io//linux/[base64 string]/[targeted email address]
• http://csfinetreats.com/dacksign/MD5/6CHAR/[base64 string]
• http://dgcard.net.br/hjghcgvjhhvb/mkjbhnm/gained/heheh/[base64 string]
• http://disbrava.net/dayo/[5-character string]/captcha/[base64 string]
• http://neoparts.com.br/seyi/reh3/[base64 string]
• http://plantaspurificadoras.com/.sbud/tlkruonajo/fgdshajtrdhss/bc1qtgum47lrgswtds/[internal IPv4 address]/[targeted email address]
• http://smrt.com.sg.beautyandbait.com/re/smrt.com.sg/[targeted email address]
• http://somalavanderia.com.br/fr/01745/[base64 string]
• http://splendidanimations.com/[targeted email address]/[base64 string]
• http://teixeiraemotta.com.br/dayo/xrb5t/captcha/[base64 string]
• https://[random prefix].ableto7.com/TIeII8o/#[targeted email address]
• https://[random prefix].arterti.com/VgJK/#[targeted email address]
• https://[random prefix].blexpon.com/hRtDMY9/#[targeted email address]
• https://[random prefix].gospelmusicnet.com/[random term or string]/[random term or string]/[random term or string]/[base64 string]?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA
• https://[random prefix].itulate.com/DWoQ6nM/#[targeted email address]
• https://[random prefix].rnequit.com/RctfUcwV/#[targeted email address]
• https://[random prefix].ticemi.com/s4L8Pj/#[targeted email address]
• https://[random prefix].turbosden.it/raba/ammad/[base64 string]
• https://[random prefix].uganion.com/sJoBQ/#[targeted email address]
• https://[random prefix].unpostin.com/6r1PDyJj/#[targeted email address]
• https://[random prefix].workers.dev/?qrc=[targeted email address]
• https://[random prefix].workers.dev?qrc=[targeted email address]
• https://[random prefix].workers.dev?qrc=ammar_[targeted email address]
• https://[random prefix].x34t6.com/BmergB/#[targeted email address]
• https://[random string and target's name].energycomercio.com.br/ireYds83/uhrY6etd/[random string and target's name]/[base64 string]?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA
• https://4cut.pl//fancybox/top/[base64 string]
• https://aibuzzcentral.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://aibuzzcentral.com/[random string]/[4-digit number]/new/new[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://atmmahmud.com/kgh/[username]/[targeted email address]
• https://balazs.com.au/kenns/wp-admin/REDIRECT/aVB7r9/[targeted email address]
• https://banyan-edu.com/getit/[base64 string]/[internal IPv4 address]/[base64 string]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://betternowmentalhealth.com/rab/amma/[base64 string]
• https://bmgfacil.net.br/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true
• https://brandqube-uae.com/lr/lrl2wt/[base64 string]=?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature
• https://buildingcompetency.com/getit/[base64 string]/[internal IPv4 address]/[base64 string]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://caliber-docs.cloud/[targeted email address]
• https://cf-ipfs.com/ipfs/bafkreic7intzjnj746hcrgdbvs6xeg6tzdr2nen5jupl3nnpg7lucql4qy#[targeted email address]
• https://cf-ipfs.com/ipfs/bafkreicbn4xgfxajydu6jbz2b5b5mijjnfskkns7uufaat5fao3tjddadi#[targeted email address]
• https://cf-ipfs.com/ipfs/bafkreicj32yprjitxoyrmoxqcknj2xohjinvl5zcy6bnandbuggdki3bxu#[targeted email address]
• https://citrusgraphix.com/redirect1#[targeted email address]
• https://closedwithchrissy.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://closingdocs-portal.online/Mbhutjens02/[targeted email address]
• https://cloudflare-ipfs.com/ipfs/bafkreibu7ontzbn4ze5b2azq526ats4xdkfjynlazoc42ftwu4vwqeu3sy#[targeted email address]
• https://cloudflare-ipfs.com/ipfs/bafybeidttzbqjpfkwqqfxykad6xwlvtcxuyglqxpnkhrvnsrcccgd5j73q#[targeted email address]
• https://comlimitmarc.com/?cqjnodgy&qrc=[targeted email address]
• https://d8comunica.com.br/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://dexsdesign.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://djsherisn.sa.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://email.efficiencys.shop/networking.aspx?core=[targeted email address]
• https://email.parametter.rest/connectivities.html?more=[targeted email address]
• https://ethart.co.uk/getit/[base64 string]/[internal IPv4 address]/[base64 string]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://everychildeducationmatters.com//readme/admin/[base64 text]
• https://fe.xrqo8.ru.com/.well-known/acme-challenge/[base64 string]
• https://hampshire36.com/raba/index.htm#[targeted email address]
• https://hdweb.info/Gfughetught538hy85yt3/oriegchuruf84ghejasmz/1060D2105FUbs/[base64 string]?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA
• https://healthboxdubai.com/af/5166/ZWJyYWRmb3JkQG1yaWdsb2JhbC5vcmc=?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://homeschoolmexico.education/shjbshjhjshjsbhsj/new/bWFjLm1jZmFybGFuZEBjcmMuY29t?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true
• https://hrsmalawi.com/japan?email=xc0017[targeted email address]
• https://imbaliblends.co.za/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true
• https://ipfs.chainsafe.io/ipfs/Qmak9SYTZHYyz8iu4Rs3nbLifa3wrpGKWiNh1qM4gRpZor#[targeted email address]
• https://just-caliberrshc.cloud/[targeted email address]
• https://loginserviciodecorreo.evolutlons.tv/serviciodecorreo/#[targeted email address]
• https://matsyakanya.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://naive-bed.surge.sh#[email address]
• https://onlineservice.municipalwelland.com/?jay=[targeted email address]
• https://ournewkindofnormal.com//wp-includes/pomo/jayb/lobatan/[targeted email address]
• https://ozoneintegrale.com.br/ActiveToYvalidationformsO.3650fficeactive.html#[targeted email address]
• https://p2qcah.9mnx1.com/p2qcah/#[targeted email address]
• https://pcc.zemmz.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://produkte-testen.com/hfYEH73/smie-ejnf839921JUHDhs/18080Wirtgen-Group291tjelgd/[base64 string]?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA
• https://pub-6baf1b9cb1684476aa3325296ca875f3.r2.dev/updated.html#[targeted email address]
• https://quetzalcitygt.com/css/[base64 string]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_X_NDR_INT_&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-REC-FL-X-XX_Notdreaming_INTERNATIONAL_Recovery_DL
• https://rababnkhan.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://remoinmobiliaria.com/.sbud/Kercus/[base64 string]
• https://revistaegle.com/revistaegle/revistaegle/[base64 string]
• https://royalgourmet.com.br/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true
• https://ruthjota.com/Machine/pub-a1uyhyefgalanipamolkuenf/Worthingtonlibraries/[base64 string]?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA
• https://sa2ds.3kf2d.com/sa2ds/#[targeted email address]
• https://seehimrimmed.com/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://serenity.inf.br/GoogleCaptcha.html#[targeted email address]
• https://serenity.inf.br/REDIRECT/oIUgsz/[targeted email address]
• https://service-out-login.tylins.com/[targeted email address]
• https://singoffice.org/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://splendidanimations.com/appa/?email=[targeted email address]
• https://tracking-pastusuage.com/[targeted email address]
• https://tunisietextile.tn/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://uwm-onedrive.com/[targeted email address]
• https://veste4me.com.br/[random string]/[4-digit number]/new/new/[targeted email address]?pid=CRM&is_retargeting=true&utm_source=sf&utm_medium=crm&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&utm_campaign=nl&mktportal=NL&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150
• https://www.integratedcancercare.ca/wp-content/plugins/real/dls/chameleon/index.html#[targeted email address]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%253A%252F%252Flaunch%252F%253futm_content%253dUL_hero%2526utm_source%253dsf%2526utm_medium%253dcrm%2526utm_campaign%253dnl%2526utm_term%253dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%2526mktportal%253dNL&af_web_dp=https://bmgfacil.net.br/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%253A%252F%252Flaunch%252F%253futm_content%253dUL_hero%2526utm_source%253dsf%2526utm_medium%253dcrm%2526utm_campaign%253dnl%2526utm_term%253dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%2526mktportal%253dNL&af_web_dp=https://homeschoolmexico.education/shjbshjhjshjsbhsj/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%253A%252F%252Flaunch%252F%253futm_content%253dUL_hero%2526utm_source%253dsf%2526utm_medium%253dcrm%2526utm_campaign%253dnl%2526utm_term%253dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%2526mktportal%253dNL&af_web_dp=https://imbaliblends.co.za/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%253A%252F%252Flaunch%252F%253futm_content%253dUL_hero%2526utm_source%253dsf%2526utm_medium%253dcrm%2526utm_campaign%253dnl%2526utm_term%253dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%2526mktportal%253dNL&af_web_dp=https://royalgourmet.com.br/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%253A%252F%252Flaunch%252F%253futm_content%253dUL_hero%2526utm_source%253dsf%2526utm_medium%253dcrm%2526utm_campaign%253dnl%2526utm_term%253dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%2526mktportal%253dNL&af_web_dp=https://wmd.god21.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=http://14149-8963-8963.marksconstruction.space/home/8963/8963/8963/[targeted email address]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://aibuzzcentral.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://d8comunica.com.br/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://dexsdesign.com/[random string]/[4-digit number]/new/new/[targeted email address]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://djsherisn.sa.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://matsyakanya.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://pcc.zemmz.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://seehimrimmed.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://tunisietextile.tn/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://veste4me.com.br/ndh/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=//buildingcompetency.com/getit/[base64 string]/[internal IPv4 address]/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://aibuzzcentral.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://banyan-edu.com/getit/[base64 string]/[internal IPv4 address]/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://closedwithchrissy.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://ethart.co.uk/getit/[base64 string]/[internal IPv4 address]/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://healthboxdubai.com/af/5166/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://pcc.zemmz.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://rababnkhan.com/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://singoffice.org/[random string]/[4-digit number]/new/new/[base64 string]
• opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app://launch/?utm_content=UL_hero&utm_source=sf&utm_medium=crm&utm_campaign=nl&utm_term=XX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150&mktportal=NL&af_web_dp=https://tunisietextile.tn/[random string]/[4-digit number]/new/new/[base64 string]
• speedpython.com/wp-includez/adminaccess/cgi-ins/hcsfedsukygfrhi/index.php?userid=[targeted email address]
• tracker.club-os.com/campaign/click?99559ms99559gId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=somalavanderia.com.br/fr/01745/[base64 string]
• tracker.club-os.com/campaign/click?msgId=40CHAR&target=babasturizm.com/costin/nymb/coartst/aouth/[base64 string]
• tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=neoparts.com.br/seyi/reh3/[base64 string]
• tracker.club-os.com/campaign/click?msgId=dipf838c6bd137e6a03157c6c728cbc659e734fc398%26test=false%26target=disbrava.net/dayo/4tdqb/captcha/[base64 string]
• tracker.club-os.com/campaign/click?msgId=dskd838c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=teixeiraemotta.com.br/dayo/xrb5t/captcha/[base64 string]
• tracker.club-os.com/campaign/click?msgId=dvqv838c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=circuitovtr.com.br/dayo/2ttbs/captcha/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=claimmysurplusfunds.com/claimmysurplusfunds/claimmysurplusfunds/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=dgcard.net.br/hjghcgvjhhvb/mkjbhnm/gained/heheh/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=http://beautyandbait.com/re/xc0017xc0017/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=http://smrt.com.sg.beautyandbait.com/re/smrt.com.sg/[targeted email address]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=https://[random prefix].turbosden.it/raba/ammad/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=https://betternowmentalhealth.com/rab/amma/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=https://remoinmobiliaria.com/.sbud/Kercus/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=revistaegle.com/revistaegle/revistaegle/[base64 string]
• tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com/[targeted email address]/[base64 string]
• tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=cryptochronicles.io//linux/[base64 string]/[targeted email address]
• tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=csfinetreats.com/dacksign/MD5/6CHAR/[base64 string]
• tracker.club-os.com/campaign/click?utp=consumer&&msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=plantaspurificadoras.com/.sbud/tlkruonajo/fgdshajtrdhss/bc1qtgum47lrgswtds/[IPv4 address]/[recipient's email address]
• travellink.onelink.me/6W7x?pid=TransactionalEmails&af_adset=ConfirmationEmail&af_ad=ConfirmationEmail_ICE_ICE3171_A_PRIME_KEEP1792_A&is_retargeting=true&af_web_dp=https://singpass-api.com/.tmp/___WDBG___[base64 string]
• walmart.onelink.me/UIev?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA&af_dp=walmart%3A%2F%2Fhome&af_web_dp=https%3A%2F%2Fprodukte-testen.com/hfYEH73/smie-ejnf839921JUHDhs/18080Wirtgen-Group291tjelgd/[base64 string]
• walmart.onelink.me/UIev?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA&af_dp=walmart://home&af_web_dp=https://[random prefix].gospelmusicnet.com/pub-a1uyhyefgalanipamolkuenf/amazon-youtube/Weilerabrasives/[base64 string]
• walmart.onelink.me/UIev?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA&af_dp=walmart://home&af_web_dp=https://[random string and target's username].energycomercio.com.br/ireYds83/uhrY6etd/[random string and target's username]/[base64 string]
• walmart.onelink.me/UIev?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA&af_dp=walmart://home&af_web_dp=https://hdweb.info/Gfughetught538hy85yt3/oriegchuruf84ghejasmz/[base64 string]
• walmart.onelink.me/UIev?pid=Email&c=W-FY18Q4-Email-BTH-O-DG-General-AppDLFooter-BOTH-NA-NA&af_dp=walmart://home&af_web_dp=https://ruthjota.com/Machine/pub-a1uyhyefgalanipamolkuenf/Worthingtonlibraries/[base64 string]