Und wieder mal mit vielen Redirects:


header:
01: Received: from ip9.buyatdoorstep.online ([139.99.248.227]) by mx-ha.gmx.net
02: (mxgmx016 [212.227.15.9]) with ESMTPS (Nemesis) ID: [ID filtered]
03: for <x>; Fri, 28 Aug 2020 xx:xx:xx +0200


header:
01: Received: from ip3.borntodanceonline.com ([139.99.250.127]) by mx-ha.gmx.net
02: (mxgmx017 [212.227.15.9]) with ESMTPS (Nemesis) ID: [ID filtered]
03: for <x>; Sun, 30 Aug 2020 xx:xx:xx +0200

whois:http://worldd4youu.com/cvsshopper/cvsrewards/mixuser/purecvs/rewards/mixcvs
IP: 147.135.59.132 -> AS16276 OVH SAS

Weiterleitungskette:

whois:http://pabias.com
IP: 52.71.111.21 -> AS14618 Amazon.com, Inc.

whois:http://vu1.yourofferlink.company
IP: 107.179.2.226 -> AS46573 LayerHost

whois:http://p6tjoe.b8p1pe6trd.top
IP: 179.61.143.11 -> AS61317 Digital Energy Technologies Ltd.

whois:http://tracking.trkkadsm.com
IP: 34.250.4.239 -> AS16509 Amazon.com, Inc.

whois:http://campaign.golead.de
IP: 138.201.125.228 -> Hetzner

whois:http://de3.my-new-smartphone.com/campaign_428.html
IP: 138.201.125.228 -> AS24940 Hetzner Online GmbH

Und natürlich mit OVH und Hetzner mal wieder großen Güllegruben des Internets dabei...