Spoofing:
Received: from emerson.com (cestabasica.recife.pe.gov.br. [94.102.13.6])
Malicious pay ...
show moreSpoofing:
Received: from emerson.com (cestabasica.recife.pe.gov.br. [94.102.13.6])
Malicious payload:
https://storage.googleapis.com/savelinge/clearpath.html
Redirection to phishing site:
https://aurevions.com/
show less
Email Spam
Spoofing
Phishing
Anonymous
Received: from tbs.com (ioc.ucdavis.edu. [94.102.13.6])
Phishing
Email Spam
Spoofing
Anonymous
Received: from oktopost.com (ioc.ucdavis.edu. [94.102.13.6])
[email protected] ...
show moreReceived: from oktopost.com (ioc.ucdavis.edu. [94.102.13.6])
[email protected]
Subject: Give Your Home a Robotic Best Friend Today
show less
From: "Verification๐" <[email protected]> (Re: Your Photos and Videos will be dele ...
show moreFrom: "Verification๐" <[email protected]> (Re: Your Photos and Videos will be deleted - Take Action!________6285211)
show less
Phishing
Open Proxy
Email Spam
Spoofing
Exploited Host
Anonymous
Received: from disneyplus.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com ...
show moreReceived: from disneyplus.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ESMTPS id 4fb4d7f45d1cf-658b47ca0casi5112001a12.213.2026.01.29.07.38.08
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Thu, 29 Jan 2026 07:38:08 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 94.102.13.6 as permitted sender) client-ip=94.102.13.6;
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from rover.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ...
show moreReceived: from rover.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ESMTPS id a640c23a62f3a-b8dbf31cc78si232286766b.183.2026.01.28.06.57.34
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Wed, 28 Jan 2026 06:57:34 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 94.102.13.6 as permitted sender) client-ip=94.102.13.6;
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from bhphotovideo.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.c ...
show moreReceived: from bhphotovideo.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ESMTPS id 5b1f17b1804b1-4801e8c8f0esi27510745e9.65.2026.01.18.08.15.45
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Sun, 18 Jan 2026 08:15:45 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 94.102.13.6 as permitted sender) client-ip=94.102.13.6;
show less
Phishing
Email Spam
Spoofing
Anonymous
Phishing Cluster "462-9330" - Configuration Error & Spoofing
1. Cluster Identity: This IP is part ...
show morePhishing Cluster "462-9330" - Configuration Error & Spoofing
1. Cluster Identity: This IP is part of the "462-9330" phishing cluster (Header: X-Destination-ID: 462-9330).
2. Malicious Payload: It is distributing "Car Insurance" spam that mistakenly links to a Google Drive Phishing page (storage.googleapis.com/rightsmoves/northwodtech.html), indicating a botnet configuration error.
3. Spoofing: The IP resolves to virl-dev-innovate.cisco.com (Fake PTR) to impersonate Cisco infrastructure, but sends HELO as mlive.com.
4. Evasion: Uses scraped "Guardian" news text (Bayesian poisoning) to bypass spam filters.
5. Evidence: Unsolicited email received Jan 17, 2026.
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from cdiscount.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com ...
show moreReceived: from cdiscount.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ESMTPS id ffacd0b85a97d-43569920492si3748789f8f.80.2026.01.16.05.21.43
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Fri, 16 Jan 2026 05:21:43 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 94.102.13.6 as permitted sender) client-ip=94.102.13.6;
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from payscale.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com w ...
show moreReceived: from payscale.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ESMTPS id ffacd0b85a97d-43569ba3beesi259997f8f.401.2026.01.15.10.10.57
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Thu, 15 Jan 2026 10:10:58 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 94.102.13.6 as permitted sender) client-ip=94.102.13.6;
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from pantone.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com wi ...
show moreReceived: from pantone.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ESMTPS id 4fb4d7f45d1cf-654121af975si2972232a12.207.2026.01.15.07.00.28
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Thu, 15 Jan 2026 07:00:29 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 94.102.13.6 as permitted sender) client-ip=94.102.13.6;
show less
Phishing
Email Spam
Spoofing
Anonymous
Received: from brides.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com wit ...
show moreReceived: from brides.com (virl-dev-innovate.cisco.com. [94.102.13.6])
by mx.google.com with ESMTPS id 4fb4d7f45d1cf-6541219d513si210270a12.110.2026.01.14.09.09.48
(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);
Wed, 14 Jan 2026 09:09:48 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 94.102.13.6 as permitted sender) client-ip=94.102.13.6;
show less