PDF im Anhang mit der initialen URL.

header:
01: Received: from APC01-PU1-obe.outbound.protection.outlook.com ([40.92.254.39])
02: by mx-ha.gmx.net (mxgmx116 [212.227.17.5]) with ESMTPS (Nemesis) id
03: x for <x>; Tue, 18 May 2021 xx:xx:xx
04: +0200
05: ARC-Seal:
Beworbene Domain IP Adresse(n) Weiterleitung (j/n)
whois:http://59droog.sed.afterthestormfilm.com whois:193.109.84.23 [X] ja / [ ] nein
whois:http://daserfared.temp.swtest.ru
/dat_1
whois:77.222.40.109 [X] ja / [ ] nein
whois:https://gerl-s.online
/?s1=ptt1
whois:185.117.155.198 [X] ja / [ ] nein
whois:https://dategen.com
/click?email=*schnapp*
&s1=ptt1
&s2=
&s3=12
&s4=
&l=12
&src=mec
&v=dating
&trx_s=*schnapp*
&tz=*schnapp*
&remember=0
whois:2606:4700:3036::6815:58a5
whois:2606:4700:3031::ac43:ba37
whois:104.21.88.165
whois:172.67.186.55
[X] ja / [ ] nein
whois:http://dategen.com
/r
/mt
/*schnapp*
whois:2606:4700:3036::6815:58a5
whois:2606:4700:3031::ac43:ba37
whois:104.21.88.165
whois:172.67.186.55
[X] ja / [ ] nein
whois:https://dategen.com
/r
/mt
/*schnapp*
whois:2606:4700:3036::6815:58a5
whois:2606:4700:3031::ac43:ba37
whois:104.21.88.165
whois:172.67.186.55
[X] ja / [ ] nein
whois:https://trck.novatrck02.com
/*schnapp*
/*schnapp*
/?sub2=*schnapp*
&sub3=wt06jckz
whois:34.96.83.190 [X] ja / [ ] nein
whois:https://www.bmtracks.com
/aff_c?offer_id=592
&aff_id=1948
&aff_click_id=*schnapp*
&source=100301
&aff_sub=wt06jckz
whois:54.194.1.51
whois:34.255.77.156
whois:99.80.173.189
[X] ja / [ ] nein
whois:https://www.nursugarmamas.de
/campaign?utm_campaign=18319
&utm_medium=1948
&utm_source=*schnapp*
&utm_content=100301
&utm_term=wt06jckz
whois:2600:9000:21f3:da00:b:c384:fd00:93a1
whois:2600:9000:21f3:7a00:b:c384:fd00:93a1
whois:2600:9000:21f3:e00:b:c384:fd00:93a1
whois:2600:9000:21f3:3000:b:c384:fd00:93a1
whois:2600:9000:21f3:a800:b:c384:fd00:93a1
whois:2600:9000:21f3:ce00:b:c384:fd00:93a1
whois:2600:9000:21f3:2800:b:c384:fd00:93a1
whois:2600:9000:21f3:1a00:b:c384:fd00:93a1
whois:13.225.74.39
whois:13.225.74.46
whois:13.225.74.42
whois:13.225.74.25
[X] ja / [ ] nein
whois:https://www.nursugarmamas.de
/landingpage
whois:2600:9000:21f3:da00:b:c384:fd00:93a1
whois:2600:9000:21f3:7a00:b:c384:fd00:93a1
whois:2600:9000:21f3:e00:b:c384:fd00:93a1
whois:2600:9000:21f3:3000:b:c384:fd00:93a1
whois:2600:9000:21f3:a800:b:c384:fd00:93a1
whois:2600:9000:21f3:ce00:b:c384:fd00:93a1
whois:2600:9000:21f3:2800:b:c384:fd00:93a1
whois:2600:9000:21f3:1a00:b:c384:fd00:93a1
whois:13.225.74.39
whois:13.225.74.46
whois:13.225.74.42
whois:13.225.74.25
[X] ja / [ ] nein
whois:https://www.nursugarmamas.de/ whois:2600:9000:21f3:da00:b:c384:fd00:93a1
whois:2600:9000:21f3:7a00:b:c384:fd00:93a1
whois:2600:9000:21f3:e00:b:c384:fd00:93a1
whois:2600:9000:21f3:3000:b:c384:fd00:93a1
whois:2600:9000:21f3:a800:b:c384:fd00:93a1
whois:2600:9000:21f3:ce00:b:c384:fd00:93a1
whois:2600:9000:21f3:2800:b:c384:fd00:93a1
whois:2600:9000:21f3:1a00:b:c384:fd00:93a1
whois:13.225.74.39
whois:13.225.74.46
whois:13.225.74.42
whois:13.225.74.25
[ ] ja / [X] nein

Code:
Die Leistungen auf nursugarmamas.de werden erbracht von der Paidwings AG, mit Sitz in der Alte Steinhauserstrasse 1, 6330 Cham, Switzerland. Die Paidwings AG ist unter der Registernummer CHE-372.592.771 im Kanton Zug im Handelsregister eingetragen und wird unter der Mehrwertsteuernummer CHE-372.592.771 MWST beim Finanzregister geführt. Als Verwaltungsrat der AG fungiert x. Für anderweitige Kontaktaufnahmen steht unsere Faxnummer zur Verfügung +41 (0) 41 5087019. Alle anderen Anliegen beantworten wir schnell und zuverlässig in unserem Supportbereich.