Fake Swiss Railways mail
Received: from dcdir1-prd-nl1-sun.nl1.unified.services ([100.105.128.42])
...
show moreFake Swiss Railways mail
Received: from dcdir1-prd-nl1-sun.nl1.unified.services ([100.105.128.42])
(envelope-from <010001a0a277dec5-57cd3d06-dd58-4d25-998c-7ae9df7583c4-000000@atlassian-bounces.atlassian.net>)
for <[email protected]>; Tue, 15 Sep 2026 02:29:21 +0200
Authentication-Results: edge.unified.services;
spf=pass (216.221.175.211;atlassian-bounces.atlassian.net);
dkim=pass header.d=atlassian.net;
dkim=pass header.d=amazonses.com;
dmarc=pass header.from=coop-sweden.atlassian.net (p=reject sp=reject dis=pass)
X-Env-Mailfrom: 010001a0a277dec5-57cd3d06-dd58-4d25-998c-7ae9df7583c4-000000@atlassian-bounces.atlassian.net
X-SourceIP: 216.221.175.211
Date: Tue, 15 Sep 2026 00:29:19 +0000
From: SBB CFF FFS <[email protected]>
Subject: Hinweis zu Ihrem Zugang
Guten Tag,
wir moechten Sie darueber informieren, dass im Rahmen einer routinemaessigen Kontopruefung eine Aktualisierung einzelner Angaben vo
show less
fake MIGROS mail
(envelope-from <[email protected]>)
for <[email protected]>; Sun, 30 Aug 2026 ...
show morefake MIGROS mail
(envelope-from <[email protected]>)
for <[email protected]>; Sun, 30 Aug 2026 13:03:04 +0200
Authentication-Results: edge.unified.services;
spf=pass (81.7.5.83;legel.net);
dkim=none (nosigs);
dmarc=none header.from=alterterra.fr (dis=no_record)
X-Env-Mailfrom: [email protected]
X-SourceIP: 81.7.5.83
Received: from legel.net ([81.7.5.83])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 256/256 bits)
(Client did not present a certificate)
by mx3-prd-nl1-sun.edge.unified.services with ESMTPS
id 0dJWxluNj7woA0dJXx6Ht4; Sun, 30 Aug 2026 13:03:03 +0200
Date: Sun, 30 Aug 2026 06:44:41 -0400
From: MigrosBelohnung <[email protected]>
Subject: Belohnung: Deine gratis Migros-Lebensmittelbox #80739020CH
show less
Fake McAfee
(envelope-from <[email protected]>)
for <[email protected]>; Wed, 19 Aug 2026 12:33 ...
show moreFake McAfee
(envelope-from <[email protected]>)
for <[email protected]>; Wed, 19 Aug 2026 12:33:23 +0200
Authentication-Results: edge.unified.services;
spf=pass (199.245.176.154;wmq-hg684.com);
pass header.from=wnndj-v3-update.wmq-hg684.com (p=none sp=none dis=pass)
X-Env-Mailfrom: [email protected]
Received: from wmq-hg684.com ([199.245.176.154])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 256/256 bits)
(Client did not present a certificate)
by mx3-prd-nl1-sun.edge.unified.services with ESMTPS
id wdbmwL98W7woAwdbnwjqcB; Wed, 19 Aug 2026 12:33:23 +0200
Date: Wed, 19 Aug 2026 06:33:22 -0400
Feedback-Id: ip.0f2fa25c:la.jira.PO-jsm-cn-request-created:1.us-east-1.qR2QuL7RnaYmnR6598861773lkgzZ+MHWEm101rQenX9XjE=:AmazonSES
From: "xxxxxx" <[email protected]>
References: <[email protected]>
<JIRA.18816.0714566859@5b2312c19b94>
Subject: Wir haben Ihre persönlichen Daten im Darknet gefunden
show less
Fake McAfee
(envelope-from <[email protected]>)
for <[email protected]>; Wed, 15 Jul 2026 ...
show moreFake McAfee
(envelope-from <[email protected]>)
for <[email protected]>; Wed, 15 Jul 2026 18:50:45 +0200
Authentication-Results: edge.unified.services;
spf=pass (149.210.181.229;lissooula.jpn.com);
dkim=none (nosigs);
dmarc=pass header.from=lissooula.jpn.com (p=none sp=none dis=pass)
X-Env-Mailfrom: [email protected]
X-Env-Rcptto: [email protected]
X-SourceIP: 149.210.181.229
...
<p style="margin: 0 0 15px 0;">
wir möchten Sie darüber informieren, dass Ihr Abonnement für McAfee Total Protection bald ausläuft oder bereits in die Verlängerungsphase übergegangen ist.
show less
fake SERAFE swiss tv taxes
Received: from smtpclienthelo ([100.105.128.12])
by dcdir3-prd-nl1-sun ...
show morefake SERAFE swiss tv taxes
Received: from smtpclienthelo ([100.105.128.12])
by dcdir3-prd-nl1-sun.nl1.unified.services with LMTP
id iEjCNdbmMGqPaBQAUw4nEQ:T5264
(envelope-from <0100019ed33abefd-f9b1a615-0318-4843-8020-8f9145823cd6-000000@atlassian-bounces.atlassian.net>)
for <[email protected]>; Wed, 17 Jun 2026 03:38:24 +0200
Received: from g175-186.smtp-out.amazonses.com ([216.221.175.186])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 256/256 bits)
(Client did not present a certificate)
Reply-To: <[email protected]>
From: "Serafe AG" <[email protected]>
To: <[email protected]>
References: <[email protected]> <JIRA.78956.1781660255412@ed1ca5ed7b60>
In-Reply-To: <[email protected]>
Subject: =?utf-8?Q?Kontoauszug_f=C3=BCr_Referenz_PAUSE-6?=
=?utf-8?Q?8855?=
Date: Wed, 17 Jun 2026 03:38:23 +
show less
Fake ULYS mail asking for payment Received: from DS7P221CA0038.NAMP221.PROD.OUTLOOK.COM (2603:10b6:8 ...
show moreFake ULYS mail asking for payment Received: from DS7P221CA0038.NAMP221.PROD.OUTLOOK.COM (2603:10b6:8:25e::19) by VI1PR09MB3806.eurprd09.prod.outlook.com (2603:10a6:803:12e::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.113.16; Sun, 14 Jun 2026 00:36:17 +0000 Received-SPF: Pass (protection.outlook.com: domain of em1929.park.marketing.pbc.gov designates 149.72.120.130 as permitted sender) receiver=protection.outlook.com; client-ip=149.72.120.130; helo=s.wrqvtvvn.outbound-mail.sendgrid.net; pr=C eceived: from s.wrqvtvvn.outbound-mail.sendgrid.net (149.72.120.130) by SA2PEPF000015C8.mail.protection.outlook.com (10.167.241.198) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.8 via Frontend Transport; Sun, 14 Jun 2026 00:36:15 +0000 From: ServiceUIys <[email protected]> Message-ID: <DYHoeJasSXSLbyiBlP9snQ@geopod-ismtpd-44> Subject: Passage au =?UTF-8?B?cMOpYWdl?= non pris en compte
show less
Fake ULYS mail asking for payment
Received: from DS7P221CA0038.NAMP221.PROD.OUTLOOK.COM (2603:10b6: ...
show moreFake ULYS mail asking for payment
Received: from DS7P221CA0038.NAMP221.PROD.OUTLOOK.COM (2603:10b6:8:25e::19) by
VI1PR09MB3806.eurprd09.prod.outlook.com (2603:10a6:803:12e::22) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.113.16; Sun, 14 Jun
2026 00:36:17 +0000
Received-SPF: Pass (protection.outlook.com: domain of
em1929.park.marketing.pbc.gov designates 149.72.120.130 as permitted sender)
receiver=protection.outlook.com; client-ip=149.72.120.130;
helo=s.wrqvtvvn.outbound-mail.sendgrid.net; pr=C
eceived: from s.wrqvtvvn.outbound-mail.sendgrid.net (149.72.120.130) by
SA2PEPF000015C8.mail.protection.outlook.com (10.167.241.198) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.8
via Frontend Transport; Sun, 14 Jun 2026 00:36:15 +0000
From: ServiceUIys <[email protected]>
Message-ID: <DYHoeJasSXSLbyiBlP9snQ@geopod-ismtpd-44>
Subject: Passage au =?UTF-8?B?cMOpYWdl?= non pris en compte
show less
fake Swiss Touring Club mail
Received: from smtpclienthelo ([100.105.128.43])
by dcdir5-prd-nl1-s ...
show morefake Swiss Touring Club mail
Received: from smtpclienthelo ([100.105.128.43])
by dcdir5-prd-nl1-sun.nl1.unified.services with LMTP
id sPIuAexoK2oApQoAs1GO1A:T5058
(envelope-from <[email protected]>)
for <[email protected]>; Fri, 12 Jun 2026 17:57:45 +0200
Authentication-Results: edge.unified.services;
spf=pass (198.23.158.43;thuvienphapluat.vn);
dmarc=fail header.from=nicolas.chiranti.info (p=none sp=none dis=monitor)
X-Env-Mailfrom: [email protected]
Received: from nicolas.chiranti.info ([198.23.158.43])
From: "Touring-Club" <[email protected]>
Subject: Bestätigung erforderlich
show less
Fake Amazon Prime mail
Received: from DS2PEPF000061C4.namprd02.prod.outlook.com
(2603:10b6:8:45e: ...
show moreFake Amazon Prime mail
Received: from DS2PEPF000061C4.namprd02.prod.outlook.com
(2603:10b6:8:45e:cafe::f) by DS3P221CA0007.outlook.office365.com
(2603:10b6:8:45e::10) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.113.14 via Frontend Transport; Thu,
11 Jun 2026 21:25:18 +0000
Authentication-Results: spf=pass (sender IP is 159.183.224.107)
smtp.mailfrom=em6922.absistemas.com.br; dkim=pass (signature was verified)
header.d=absistemas.com.br;dmarc=pass action=none
header.from=absistemas.com.br;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of em6922.absistemas.com.br
designates 159.183.224.107 as permitted sender)
receiver=protection.outlook.com; client-ip=159.183.224.107;
Date: Thu, 11 Jun 2026 21:24:51 +0000 (UTC)
From: PrimeVideo <[email protected]>
Mime-Version: 1.0
Message-ID: <v0AcjZjoQgirMCmK4Rv9_w@geopod-ismtpd-20>
show less
Fake McAfee mail
Received: from payeakalbutin.net ([69.162.118.221])
(using TLSv1.3 with cipher T ...
show moreFake McAfee mail
Received: from payeakalbutin.net ([69.162.118.221])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 256/256 bits)
(Client did not present a certificate)
by mx4-prd-nl1-sun.edge.unified.services with ESMTPS
id XMpVwsotjhdOMXMpVwvObi; Wed, 10 Jun 2026 19:35:05 +0200
Date: Wed, 10 Jun 2026 13:31:11 -0400
From: "McAfee Sicherheits-Partner" <[email protected]>
To: [email protected]
Message-ID: <01020188329e1fb7-eufd30nb-2f3a-4a92-ba1f-nxn6ky91e4on-000000@eu-west-1.amazonses.com>
Subject: Aktualisieren Sie Ihre Zahlungsdaten sicher
show less
FAKE Amazon prime mail
Received-SPF: Pass (protection.outlook.com: domain of em6878.gpsinsight.com
...
show moreFAKE Amazon prime mail
Received-SPF: Pass (protection.outlook.com: domain of em6878.gpsinsight.com
designates 159.183.214.110 as permitted sender)
receiver=protection.outlook.com; client-ip=159.183.214.110;
helo=wfbtdssz.outbound-mail.sendgrid.net; pr=C
Received: from wfbtdssz.outbound-mail.sendgrid.net (159.183.214.110) by
SJ5PEPF00000203.mail.protection.outlook.com (10.167.244.36) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.113.7
via Frontend Transport; Mon, 8 Jun 2026 00:19:14 +0000
Date: Sun, 07 Jun 2026 22:32:19 +0000 (UTC)
From: PrimeAMZ <[email protected]>
Message-ID: <M7bnR0eARYuzHdrNv5yWyw@geopod-ismtpd-114>
Subject: Votre abonnement Prime a =?UTF-8?B?w6l0w6kgY29uZmlybcOp?=
X-SG-EID:
show less
Received: from PA2PR09MB7077.eurprd09.prod.outlook.com (::1) by
AMBPR09MB8380.eurprd09.prod.outloo ...
show moreReceived: from PA2PR09MB7077.eurprd09.prod.outlook.com (::1) by
AMBPR09MB8380.eurprd09.prod.outlook.com with HTTPS; Sun, 7 Jun 2026 09:51:25
Received: from BN9PR03CA0925.namprd03.prod.outlook.com (2603:10b6:408:107::30)
by PA2PR09MB7077.eurprd09.prod.outlook.com (2603:10a6:102:404::6) 15.21.92.11; Sun, 7 Jun 2026 09:51:25 +0000
Received: from BN3PEPF0000B075.namprd04.prod.outlook.com
(2603:10b6:408:107:cafe::5e) by BN9PR03CA0925.outlook.office365.com
(2603:10b6:408:107::30) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.12 via Frontend Transport; Sun, 7 Jun 2026 09:51:24 +0000
Authentication-Results: spf=pass (sender IP is 159.183.136.207)
smtp.mailfrom=em2762.propumps.co.uk; dkim=pass (signature was verified)
header.d=propumps.co.uk;dmarc=pass action=none
header.from=propumps.co.uk;compauth=pass rea
receiver=protection.outlook.com; client-ip=159.183.136.207;
show less
Fake French Highway Toll invoicing
Received: from BN3PEPF0000B075.namprd04.prod.outlook.com
(2603 ...
show moreFake French Highway Toll invoicing
Received: from BN3PEPF0000B075.namprd04.prod.outlook.com
(2603:10b6:408:107:cafe::5e) by BN9PR03CA0925.outlook.office365.com
(2603:10b6:408:107::30) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.12 via Frontend Transport; Sun, 7
Jun 2026 09:51:24 +0000
Authentication-Results: spf=pass (sender IP is 159.183.136.207)
receiver=protection.outlook.com; client-ip=159.183.136.207;
show less