I see now: It's in the domain name registration. MA = Morocco too.

Is Morocco the name of a spambot? If so, what product denotes the detection?

@ Fred Nurk, I posted this for your use today. https://forum.mywot.com /viewtopic.php?f=3&t=3136&p=263687#p263687 (there's an intentional break-space in the link due to an error in the forum formatting) There are also malware URL, etc reporting sites and addresses to antivirus venders, that I have i...

Report spam : www.fortiguard.com/learnmore#as (Lookup to see if already blocked by fortiguard) submitspam@service.fortinet.com (Forward spam as attachment) www.fortiguard.com/webfilter (Spam URL and resolves-to URL. "Spam URL" or "Malicious website".) www.brightcloud.com/tools/url-ip-lookup.php / W...

ifehp.today is offline presently, still registered. @Fred Nurk the samples seem highly under-reported, I suggest reporting and/or forwarding--as attachments--the emails to blocklists.

ordercotton.xyz:
http://aceinsight.websense.com "Elevated exposure"

loyalpermissiondude.xyz:
http://aceinsight.websense.com "Elevated exposure"
https://hosts-file.net/?s=loyalpermissiondude.xyz

cla-best-extract.com destination
from http://weight-dietloss.com/us/uucu/go.p ... BhsmpNr8gB
from link, redirect weight-dietloss.com
from enjoy.robertconwaychildress.com spam URL, redirect
from open spam relay

===R01-RU===
onlinebestgroup.ru

===REGRU-SU===
bestrealm.su
realsalen.su

===R01-RU===
pureherbservices.ru