2018-02-20 - Pharmacy spam from the Necurs Botnet

Pharmacy spam from (what I think is) the Necurs Botnet

2018-02-19 17:05 UTC -- Received: from Admin-PC ([123.28.169.41]) -- From: "Trisha" <Trisha@gmail.com> -- Subject: Discount 89735947 -- Attachment: offer_20_89735947.pdf
2018-02-19 17:08 UTC -- Received: from dial-148-240-178-42.zone-2.ip.static-ftth.axtel.net.mx ([148.240.178.42]) -- From: "Lawanda" <Lawanda@gmail.com> -- Subject: Coupon 2525698 -- Attachment: coupon_30_2525698.pdf
2018-02-19 17:26 UTC -- Received: from 45.42.153.190.net-uno.net ([190.153.42.45]) -- From: "Concetta" <Concetta@gmail.com> -- Subject: Discount 2196318 -- Attachment: coupon_50_2196318.pdf
2018-02-19 17:32 UTC -- Received: from static.vnpt.vn ([14.166.117.45]) -- From: "Ana" <Ana@gmail.com> -- Subject: Sale 205442671 -- Attachment: sale_50_205442671.pdf
2018-02-19 17:50 UTC -- Received: from fixed-187-189-83-226.totalplay.net ([187.189.83.226]) -- From: "Christian" <Christian@gmail.com> -- Subject: Final sale 31201433 -- Attachment: offer_30_31201433.pdf
2018-02-19 17:53 UTC -- Received: from 189-209-101-117.static.axtel.net ([189.209.101.117]) -- From: "Sheryl" <Sheryl@gmail.com> -- Subject: Final sale 887356567 -- Attachment: discount_50_887356567.pdf
2018-02-19 19:00 UTC -- Received: from static.vnpt.vn ([14.232.206.64]) -- From: "Juliana" <Juliana@gmail.com> -- Subject: Offer 931862426 -- Attachment: sale_30_931862426.pdf
2018-02-19 19:17 UTC -- Received: from 94-183-237-237.shatel.ir ([94.183.237.237]) -- From: "Odessa" <Odessa@gmail.com> -- Subject: Discount 6424127 -- Attachment: discount_50_6424127.pdf
2018-02-19 19:44 UTC -- Received: from static-ip-cr1901471364.cable.net.co ([190.147.136.4]) -- From: "Denver" <Denver@gmail.com> -- Subject: Offer 1106422 -- Attachment: promo_20_1106422.pdf
2018-02-19 20:45 UTC -- Received: from static-ip-186146135251.cable.net.co ([186.146.135.251]) -- From: "Hattie" <Hattie@gmail.com> -- Subject: Discount 722315346 -- Attachment: coupon_50_722315346.pdf
2018-02-19 20:47 UTC -- Received: from 184-82-37-0.24.public.knkon-mser01.myaisfibre.com ([184.82.37.91]) -- From: "Rolando" <Rolando@gmail.com> -- Subject: Discount 1164374 -- Attachment: offer_50_1164374.pdf
2018-02-19 21:01 UTC -- Received: from 187-248-22-34.internetmax.maxcom.net.mx ([187.248.22.34]) -- From: "Emmett" <Emmett@gmail.com> -- Subject: Discount 0194871 -- Attachment: promo_30_0194871.pdf
2018-02-20 11:45 UTC -- Received: from static.vnpt.vn ([113.169.11.229]) -- From: "Blanche" <Blanche@gmail.com> -- Subject: Offer 32456153 -- Attachment: coupon_20_32456153.pdf
2018-02-20 11:48 UTC -- Received: from abts-north-dynamic-126.141.173.122.airtelbroadband.in ([122.173.141.126]) -- From: "Gail" <Gail@gmail.com> -- Subject: Discount 315068325 -- Attachment: offer_20_315068325.pdf
2018-02-20 12:03 UTC -- Received: from dsl-201-109-16-69-sta.prod-empresarial.com.mx ([201.109.16.69]) -- From: "Adrienne" <Adrienne@gmail.com> -- Subject: Coupon 5756417 -- Attachment: sale_50_5756417.pdf
2018-02-20 12:03 UTC -- Received: from bb7b1148.virtua.com.br ([187.123.17.72]) -- From: "Augusta" <Augusta@gmail.com> -- Subject: Discount 8438883 -- Attachment: sale_20_8438883.pdf
2018-02-20 12:03 UTC -- Received: from abts-tn-dynamic-205.193.65.182.airtelbroadband.in ([182.65.193.205]) -- From: "Yesenia" <Yesenia@gmail.com> -- Subject: Coupon 14377700 -- Attachment: discount_50_14377700.pdf
2018-02-20 12:39 UTC -- Received: from 118.69.118.77 ([118.69.118.77]) -- From: "Freida" <Freida@gmail.com> -- Subject: Discount 6153830 -- Attachment: sale_20_6153830.pdf
2018-02-20 12:40 UTC -- Received: from static.vnpt.vn ([113.176.7.48]) -- From: "Bettye" <Bettye@gmail.com> -- Subject: Coupon 7665231 -- Attachment: discount_50_7665231.pdf
2018-02-20 12:41 UTC -- Received: from host-41.33.69.35.tedata.net ([41.33.69.35]) -- From: "Fanny" <Fanny@gmail.com> -- Subject: Coupon 4765185 -- Attachment: discount_50_4765185.pdf
2018-02-20 12:43 UTC -- Received: from static-190-181-29-43.acelerate.net ([190.181.29.43]) -- From: "Lilly" <Lilly@gmail.com> -- Subject: Final sale 2021913 -- Attachment: promo_30_2021913.pdf
2018-02-20 12:45 UTC -- Received: from 192-140-35-200.rnvcorp.net.br ([192.140.35.200]) -- From: "Zelma" <Zelma@gmail.com> -- Subject: Discount 698543824 -- Attachment: coupon_50_698543824.pdf
2018-02-20 12:46 UTC -- Received: from TODD_LOFTON.JCC ([12.163.179.198]) -- From: "Mason" <Mason@gmail.com> -- Subject: Sale 828351159 -- Attachment: offer_30_828351159.pdf
2018-02-20 12:47 UTC -- Received: from VIETFORUM ([103.199.23.213]) -- From: "Foster" <Foster@gmail.com> -- Subject: Sale 55153487 -- Attachment: coupon_30_55153487.pdf
2018-02-20 12:48 UTC -- Received: from abts-kk-dynamic-155.99.167.122.airtelbroadband.in ([122.178.229.247]) -- From: "Brandi" <Brandi@gmail.com> -- Subject: Final sale 9982779 -- Attachment: coupon_50_9982779.pdf
2018-02-20 12:52 UTC -- Received: from azteca-comunicaciones.com ([191.102.120.10]) -- From: "Rickie" <Rickie@gmail.com> -- Subject: Sale 74227390 -- Attachment: promo_50_74227390.pdf
2018-02-20 13:02 UTC -- Received: from static.vnpt.vn ([14.234.148.58]) -- From: "Melva" <Melva@gmail.com> -- Subject: Offer 3448588 -- Attachment: offer_50_3448588.pdf
2018-02-20 13:03 UTC -- Received: from 88.247.241.151.static.ttnet.com.tr ([88.247.241.151]) -- From: "Dianna" <Dianna@gmail.com> -- Subject: Offer 9587733 -- Attachment: sale_50_9587733.pdf
2018-02-20 13:08 UTC -- Received: from 172-131-87-183.mysipl.com ([183.87.131.172]) -- From: "Sung" <Sung@gmail.com> -- Subject: Coupon 788486456 -- Attachment: coupon_50_788486456.pdf
2018-02-20 13:15 UTC -- Received: from client-201.240.163.193.speedy.net.pe ([181.176.180.135]) -- From: "Lane" <Lane@gmail.com> -- Subject: Sale 535905388 -- Attachment: coupon_20_535905388.pdf