⚠️ Warning ⚠️

There is an active spam emails impersonating @saudipost
observed in Saudi.

https://urlscan.io/result/dd8bfb8a-e057-4855-ab96-d99925d39a38/

sender domain is freshdesk[.]com
The initial phishing domain (phishing link) is naturcosmetika[.]com is which redirects to the page above (click on @urlscanio link for full url)
Pivoting in @urlscanio for similar pages reveals a lot

check your logs for such hits !
You can follow @SaudiDFIR.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled: