20220331_VIETNAMESE_T_SHIRT_SPAMMER

MODUS OPERANDI
SPAMMER (Likely Folks from Springtree - [email protected] or Custom Name Prints - [email protected]) uses newly created Gmail accounts to peddle crappy t-shirts.  Normally uses NameCheap hosting.  From names are usually Vietnamese sounding names.  The grammar and punctuation used in their e-mails is pretty poor.  Getting their Gmail account and website links shutdown simply results in new ones being generated.  A new domain is created that simply forwards to the final destination like namezify.com.  Normally uses NameCheap web hosting.

Newest tactic is to use URL shortenting (like TinyURL) to hide the URL and CloudFlare to hide origin.

TYPICAL SUBJECTS
YOUR_NAME_HERE Looks like you may have forgotten something...

PREVIOUS LINKS
20221116 - https://tinyurl.com/5xct5fm3 or https://tinyurl.com/3hhhm77j (forwards to t-shirtforjob.shop)
https://www.virustotal.com/gui/url/90ce06ace917ee56c2c78274d7b57c8e93185083e97483e45cbb69d2eeb07fb2/details

20221103 - https://64hydro.homes/UNIQUE_STRING_HERE (forwards to nameprintz.com)
https://www.virustotal.com/gui/url/097bc7c04aa65173fd13267b0fa0f84aa8a896dc3fb4e70250b101760674d963/details

20220826 - https://lofipod.pics/UNIQUE_STRING_HERE (forwards to namezify.com)
https://www.virustotal.com/gui/url/a9bf13c2785a7d602d325a25b9abb9f7bd1a67f5e0fb4a17ce3f29fb865bc631/details

PREVIOUS GMAIL ACCOUNTS
[email protected]
[email protected]
[email protected]