also it's from the spammer's "staging" instance, so the payload is a URL with a staging hostname which doesn't even resolve 🙄