Back to Examples
PHISHINGRisk Level: 9/10

Classic cloud storage deletion scam using newly registered malicious domains to create false urgency.

HIGH ConfidenceCredential Phishing

Email Details

From
user@example.com (anonymized)
Subject
Fwd: Final Notice: Cloud Storage Deletion in Progress
Date
January 21, 2026

Key Findings

  • Newly registered malicious domain "avionteq.space" (28 days old) hosting phishing links with high-risk obfuscated URLs

  • Classic cloud storage deletion urgency scam impersonating generic "Cloud Storage System" to create false deadline pressure

  • Sender spoofing with mismatched domains - claims to be from "Cloud Storage System" but uses suspicious atlantacheaptees.space domain

Detailed Analysis

This is a high-confidence phishing attempt using a classic cloud storage deletion scam. The email creates false urgency by claiming "Final Notice: Cloud Storage Deletion in Progress" to pressure victims into clicking malicious links. The primary red flag is the newly registered domain "avionteq.space" (only 28 days old, created 2025-12-24) which hosts multiple obfuscated phishing URLs with suspicious parameters.

Newly registered domains are a strong indicator of phishing campaigns, as legitimate cloud storage providers use well-established domains registered for years. The sender impersonation is poorly executed - it claims to be from "Cloud Storage System" (a generic, non-specific service name) but the actual sender domain is "atlantacheaptees.space," another recently registered domain (33 days old).

The email contains multiple suspicious links that redirect to the malicious avionteq.space domain with long, obfuscated parameters designed to evade detection. The content uses classic urgency tactics without identifying any specific cloud service, account details, or legitimate contact information. The presence of tracking pixels and the generic nature of the threat (no specific account information) further confirms this as a mass phishing campaign.

Recommended Actions

  • Do not click any links in this email - they lead to newly registered phishing domains

  • Report this email to your IT security team and email provider as phishing

  • Block the domains avionteq.space and atlantacheaptees.space in your security systems

Get this level of protection for every email

ForwardToSafety analyzes every suspicious email with AI-powered detection to keep you safe from phishing attacks.

View Pricing Plans