Source of spoofed email forging From: @atsoho.com domain. Observed via aggregated DMARC RUA reports. ...
show moreSource of spoofed email forging From: @atsoho.com domain. Observed via aggregated DMARC RUA reports.
Between 2026-05-13 and 2026-05-17, this IP and 250+ neighbors in 193.239.154.0/24 (AS136038 HDTIDC LIMITED / AS136526 ALLCLOUD LIMITED) sent over 11,000 spoofed emails forging the From header as our domain "atsoho.com".
All messages fail SPF and DKIM authentication against atsoho.com (DMARC enforced: p=quarantine). Legitimate atsoho.com mail is sent exclusively from Google Workspace, SocketLabs, and XServer.
Reporting receivers (sample): Mail.Ru, Microsoft (Enterprise Outlook), seznam.cz, JCOM, au.com, Yahoo, GMO Pepabo, GMO Internet.
WHOIS abuse-mailbox ([email protected]) is non-functional (550 5.1.1 rejection). APNIC and RIPE NCC have been notified of the invalid abuse contact.
show less
Dec 9 01:01:36 server postfix/smtpd[3498959]: connect from unknown[193.239.154.56]
Dec 9 01:01:37 ...
show moreDec 9 01:01:36 server postfix/smtpd[3498959]: connect from unknown[193.239.154.56]
Dec 9 01:01:37 server postfix/smtpd[3498959]: NOQUEUE: reject: RCPT from unknown[193.239.154.56]: 554 5.7.1 Service unavailable; Client host [193.239.154.56] blocked using zen.spamhaus.org; Listed by SBL, see https://check.spamhaus.org/sbl/query/SBL520298 / Listed by DROP, see https://check.spamhaus.org/sbl/query/SBL520298 / Listed by CSS, see https://check.spamhaus.org/query/ip/193.239.154.56 / Listed by XBL, see https://check.spamhaus.org/query/ip/193.239.154.56; from=<> to=<[email protected]> proto=ESMTP helo=<C202512051873115.local>
...
show less
The IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, o ...
show moreThe IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
They are located at the following URL＆IP Address:
You can access the phishing site only from your smartphone.
Phishing URL:
http://owmpkqizyt.duckdns.org/ja/main
・Virus Total
https://www.virustotal.com/gui/ip-address/193.239.154.56/relations
・Urlscan
https://urlscan.io/result/e20e57cd-6336-45e0-8df8-0d60b7bd7fba/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://appleid.apple.com/ja_JP
Site owner:
Apple inc.
show less
The IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, o ...
show moreThe IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
They are located at the following URL＆IP Address:
You can access the phishing site only from your smartphone.
Phishing URL:
http://oanbiaofml.duckdns.org/ja/main
http://ojlfmupmgz.duckdns.org/ja/main
http://onejlmagxg.duckdns.org/ja/main
http://ontuhhiugg.duckdns.org/ja/main
http://ooaeexefju.duckdns.org/ja/main
http://ouqnlvwtdm.duckdns.org/ja/main
・Virus Total
https://www.virustotal.com/gui/ip-address/193.239.154.56/relations
・Urlscan
https://urlscan.io/result/bee1578b-c156-4ec3-8738-1d0799c835ee/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://appleid.apple.com/ja_JP
Site owner:
Apple inc.
show less
The IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, o ...
show moreThe IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
They are located at the following URL＆IP Address:
You can access the phishing site only from your smartphone.
Phishing URL:
http://oisuxsyszq.duckdns.org/ja/main
http://cplzymzylq.duckdns.org/ja/main
http://dbazazmlkp.duckdns.org/ja/main
http://dhzqrdkwjr.duckdns.org/ja/main
http://nxkqdjtzbz.duckdns.org/ja/main
http://oajagqtvys.duckdns.org/ja/main
・Virus Total
https://www.virustotal.com/gui/ip-address/193.239.154.56/relations
・Urlscan
https://urlscan.io/result/c9149261-4f87-40ae-b537-4c6f3ef149fc/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://appleid.apple.com/ja_JP
Site owner:
Apple inc.
show less
The IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, o ...
show moreThe IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
They are located at the following URL＆IP Address:
You can access the phishing site only from your smartphone.
Phishing URL:
http://ocdnhhwjzw.duckdns.org/ja/main
http://ocusfpkmpp.duckdns.org/ja/main
http://oetgtgtfss.duckdns.org/ja/main
http://ofouzfsjkz.duckdns.org/ja/main
http://ogicmzfpbh.duckdns.org/ja/main
・Virus Total
https://www.virustotal.com/gui/ip-address/193.239.154.56/relations
・Urlscan
https://urlscan.io/result/5fcb3dc7-1a6e-45cf-9d44-cbe161e928b4/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://appleid.apple.com/ja_JP
Site owner:
Apple inc.
show less
The IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, o ...
show moreThe IP Address(193.239.154.56) has been active since December 13, 2021.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
They are located at the following URL＆IP Address:
You can access the phishing site only from your smartphone.
Phishing URL:
http://noeepepptx.duckdns.org/japanpost/
http://pobbssrduj.duckdns.org/japanpost/
・Virus Total
https://www.virustotal.com/gui/ip-address/193.239.154.56/relations
https://www.virustotal.com/gui/domain/noeepepptx.duckdns.org/relations
https://www.virustotal.com/gui/domain/pobbssrduj.duckdns.org/relations
・Urlscan
https://urlscan.io/result/c95ed546-8c5b-4bd6-a828-ca5be90b43df/
https://urlscan.io/result/36660aeb-b059-40c5-87c9-5bcd38c47962/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://www.post.japanpost.jp/index.html
Site owner:
Japan Post Co., Ltd.
show less
Phishing
Showing 1 to
11
of 11 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩