Spam Tales: Million-Dollar Jackpot Chance

Overview

Yes, a million-dollar jackpot!

Congratulations!
You have won a 100% FREE chance to win the $1,000,000 Jackpot!
Claim your chance

The footer claims the message came from Code Rewards, which is generic enough to feel promotion-adjacent without requiring much brand impersonation effort.

Methodology

For this lure, I preserved the visible page, reviewed the message headers, and inspected the first hosted object without interacting with the final destination:

1. Capture the rendered lure.
2. Review the sender, recipient, timestamps, SPF, and DMARC result.
3. Inspect the HTML for hidden filler content and action links.
4. Decode the fragment payloads supplied in the CTA and unsubscribe URLs.
5. Fetch the Google Cloud Storage HTML object directly.
6. Review the client-side redirect script.
7. Separate reusable campaign infrastructure from likely recipient or campaign-specific values.

Tools used

• Browser developer tools in an isolated browser
• Manual Base64 decoding of the URL fragment
• curl for retrieving the first-stage HTML object
• Message source view for headers, authentication, and hidden HTML content
• Manual IOC extraction from the redirect script, message headers, and lure URL

Investigation

Email authentication

The message presented itself as:

From: CᴀsɪɴᴏRᴇᴡᴀʀᴅs <[email protected]>
Subject: user, No Deposit. No Risk. Just Real Casino Rewards!
Message-ID: <[email protected]>

Observed authentication and delivery details:

SPF:   PASS with IP 91.99.29.100
DMARC: FAIL
Return-Path: return23203@lzmhneiktu7oayw784.pc8yosm64vt5bg7784.y4jfbahri016w87784.16niztwhjrk0cu9.hotnewscam.com
Received from: hotnewscam.com (static.100.29.99.91.clients.your-server.de [91.99.29.100])

SPF passed for the long hotnewscam.com return-path subdomain, not for the visible porqxyxml.com address shown to the recipient. DMARC failed because the authenticated sending domain did not align with the visible From domain.

The raw message also contained a malformed date placeholder:

Date: _smtpDate . _EMAILID

HTML filler

After the visible lure, the message includes a hidden block beginning with:

<ObJECT>
<tiTlE>
<div style="display:none;">
<!------------ START NEGATIVE ------------>

The hidden section mixes citrus-growing prose, random strings, copied-looking newsletter fragments, and unrelated transactional email snippets. That is classic content padding to make the message body look larger, more varied, and less obviously casino-spam-shaped to simple content filters.

Original links

The lure CTA used a Google Cloud Storage object with the tracking payload placed after the fragment marker:

https://storage.googleapis.com/25kdhsale/NWBH25.html#?Z289MSZzMT0yMjc1NTE2JnMyPTQzMDAwNzA1MyZzMz1HTEI=

The fragment content is Base64-encoded campaign data. Decoded, it becomes:

go=1&s1=2275516&s2=430007053&s3=GLB

That gives us three likely campaign or recipient tracking fields:

s1=2275516
s2=430007053
s3=GLB

The unsubscribe link points to the same hosted object with a slightly different Base64 fragment:

https://storage.googleapis.com/25kdhsale/NWBH25.html#?Z289MiZzMT0yMjc1NTE2JnMyPTQzMDAwNzA1MyZzMz1HTEI=

Decoded, that becomes:

go=2&s1=2275516&s2=430007053&s3=GLB

So go=1 appears to mark the main claim action, while go=2 appears to mark the unsubscribe action. Both preserve the same s1, s2, and s3 values (since they refer to 'me'!)

Unsubscribe behavior

The go=2 sandbox run did not simply fail or return a static page. It redirected into an opt-out flow at:

vinekeymate.com/o-qqgf-e81-226d3279736e0185769db1862f53e53d

The page title was:

We are sorry to see you go

The visible form requested an email address and included a checkbox labeled:

Request a Compliance Review of this email

In the network panel, a JSON response exposed campaign and opt-out metadata:

{
  "mailer_id": 77781,
  "campaign_id": 134750,
  "cma_id": 11804529,
  "source_client_id": 7009,
  "optout_type": "email",
  "redirectStatus": "eligible",
  "leafCampaignMailerId": 1811172,
  "brandIntegrityStatus": "eligible",
  "modernOptOutPageTrafficPercent": 100
}

Redirect script

The Cloud Storage page is almost empty. Its job is to read whatever appears after #, preserve it, and forward the browser to a hard-coded IP over plain HTTP.

The fetched object served this script:

var tarcking_param = window.location.href.split('#')[1];
var srv_ip = "49.13.68.203";
if(!tarcking_param){
alert("please set tracking params!");
}else{
document.location.href = 'http://'+srv_ip+'/?'+tarcking_param;
}

The typo in tarcking_param is interesting, as AI rarely mispells!

Resulting redirect

Because the script appends the fragment value after /?, the original URL produces:

http://49.13.68.203/?Z289MSZzMT0yMjc1NTE2JnMyPTQzMDAwNzA1MyZzMz1HTEI=

After decoding the Base64 payload, the effective tracking values are:

go=1&s1=2275516&s2=430007053&s3=GLB

The first URL can carry tracking data after #, which is not sent to the server in the original HTTP request. Once JavaScript runs in the browser, the page reads that client-side fragment and turns it into a normal query-like value for the next hop.

Redirect host cover page and certificate

Browsing directly to the redirect IP over HTTPS produced a certificate warning. The certificate presented by 49.13.68.203 was not issued to the IP address; it identified:

Common Name: nsrv1854.foxfigure.com
Issued by: nsrv1854.foxfigure.com
Validity: September 24, 2025 to September 24, 2026
Chrome error: NET::ERR_CERT_AUTHORITY_INVALID

The observed SHA-256 certificate fingerprint was:

cda057b477824905d27af2b3a63cee49540b7bf2dc76188a0f3f5bafaf5291c4

The public key fingerprint shown in the browser was:

f2ec3db0a69952926a6417d06eafcc45169c4e4f737de7c64c81baa707de469

The same host also served a plain cover page at:

https://49.13.68.203/index.html

That page branded itself as:

ARBO MARKETING
new idea ,new vision
GOOD MARKETING CONSULTING SERVICE

The certificate pivot also resolved back to the same marketing template. Visiting:

foxfigure.com/index.html

served another ARBO MARKETING page with the same title and visual layout:

IOCs

storage.googleapis.com/25kdhsale/NWBH25.html
49.13.68.203
nsrv1854.foxfigure.com
foxfigure.com
foxfigure.com/index.html
cda057b477824905d27af2b3a63cee49540b7bf2dc76188a0f3f5bafaf5291c4
f2ec3db0a69952926a6417d06eafcc45169c4e4f737de7c64c81baa707de469
ARBO MARKETING
vinekeymate.com
vinekeymate.com/o-qqgf-e81-226d3279736e0185769db1862f53e53d
91.99.29.100
hotnewscam.com
porqxyxml.com
POrqXyXml.com
lzmhneiktu7oayw784.pc8yosm64vt5bg7784.y4jfbahri016w87784.16niztwhjrk0cu9.hotnewscam.com
static.100.29.99.91.clients.your-server.de
[email protected]
return23203@lzmhneiktu7oayw784.pc8yosm64vt5bg7784.y4jfbahri016w87784.16niztwhjrk0cu9.hotnewscam.com

Detection Logic

IF
HTML contains hidden display-none blocks
AND hidden content mixes unrelated article prose, random strings, and copied email snippets
THEN
spam-filter evasion padding likely

IF
HTML object reads window.location.href.split('#')[1]
AND redirects to a hard-coded IP address over HTTP
THEN
fragment-handoff redirect behavior likely

Observations & Conclusions

• SPF passed for the return-path infrastructure, but DMARC failed against the visible sender.
• The message date appears to contain an unexpanded spam-kit template value.
• The HTML includes a large hidden filler block for content-padding evasion.
• The first-stage page is hosted on Google Cloud Storage.
• CTA and unsubscribe tracking are carried in Base64-encoded fragments.
• The unsubscribe branch redirects to vinekeymate.com and exposes campaign metadata in JSON.
• The redirect IP presents an invalid certificate for nsrv1854.foxfigure.com.
• The redirect IP also serves an ARBO MARKETING cover page at /index.html.
• Client-side JavaScript converts the fragment into a redirect toward 49.13.68.203 (foxfigure).
• The hard-coded IP redirect uses plain HTTP.
• The misspelled tarcking_param variable is a small but useful clue.