

There is an active spam emails impersonating @saudipost
observed in Saudi.
https://urlscan.io/result/dd8bfb8a-e057-4855-ab96-d99925d39a38/
sender domain is freshdesk[.]com
The initial phishing domain (phishing link) is naturcosmetika[.]com is which redirects to the page above (click on @urlscanio link for full url)