neonprimetime security , just trying to help

phishing email drops a bitcoin miner and jrat out of a .IMG file with a .VBS inside X-Env-Sender: dbittnerf@gmail.com x-originating-...

This website hxxp://cdema[.]org/ (you can safely view it here at urlscan.io) https://urlscan.io/result/5776cb2c-d26d-44a8-8d58-5cd103...

I've noticed that several bitcoin miners seem to prefix their urls with the word "pool" like this one hxxp://pool1[.]xax...