Observability and operability
The spam emails in the phishing campaigns we analyzed impersonate major brands and promise a free prize. The messages only display an image, which hides an embedded hyperlink that will take the victim to a malicious website, often through a series of redirects via a traffic distribution system (TDS). The novel feature of this attack is that these image links use a reverse DNS string (used to reverse-map an IP address to a domain name via a PTR record) rather than a standard domain name. For example:
前款第一项、第二项不适用于国内海上货物运输。，更多细节参见新收录的资料
2026-02-27 00:00:00:0 习近平签署主席令。关于这个话题，新收录的资料提供了深入分析
Россиянин привез из путешествия в подарок жене на 8 Марта уголь из шахты в Воркуте
when new keywords are added to a blog posting about you.，推荐阅读新收录的资料获取更多信息