Snowshoe spam-mailer kit — decoy news homepage hosts

Web kit installed on bulk-mail ('snowshoe') spam-sending servers. Each throwaway domain sits on its own IP at a small hosting provider (Apache on Ubuntu, wildcard certificates) and serves three things: a decoy homepage titled 'Home | <domain>' that reprints a New York Times RSS section so the sender looks like a real website; a click tracker at /redirect.html?od=<token> that sends real recipients on to affiliate offers (online casinos, 'you won' prize pages, fake security warnings) and bounces recognised security scanners to a major brand's homepage; and an /out.php?email=<address> 'Unsubscribe' page pre-filled with the recipient's address, which confirms to the sender that the address is live. The domains are randomly named (e.g. thapiourgo[.]com, quisenagid[.]net, kulas.allidity[.]info, rempel.mereanreng[.]org), often with a surname as subdomain, and are replaced within weeks. Seen since at least December 2024 and still active in September 2026.