crypto scam spam from 127.0.0.1 ([192.42.116.143])
Mon, 17 Aug 2026 23:42:22 -0700 (PDT)
Subject: ...
show morecrypto scam spam from 127.0.0.1 ([192.42.116.143])
Mon, 17 Aug 2026 23:42:22 -0700 (PDT)
Subject: Re: Please ensure all compliance steps are fulfilled to proceed with the transfer
Date: Tue, 18 Aug 2026 11:42:05 +0500
Happy to be in touch! This is a temporary opportunity. LOG IN TO YOUR ACCOUNT https://telegra.ph/Memo-No-sb3opgZzh-08-17
show less
crypto scam spam from hb.d.sender-sib.com (hb.d.sender-sib.com. [77.32.148.28])
Mon, 17 Aug 2026 23 ...
show morecrypto scam spam from hb.d.sender-sib.com (hb.d.sender-sib.com. [77.32.148.28])
Mon, 17 Aug 2026 23:22:56 -0700 (PDT)
Origin-messageId: <[email protected]>
NEW MESSAGE #406378 OPEN -> withdrawer.carrd.co?
show less
crypto scam spam from smartdh02-2.aruba.it (smartdh02-2.aruba.it. [62.149.158.83])
Mon, 17 Aug 202 ...
show morecrypto scam spam from smartdh02-2.aruba.it (smartdh02-2.aruba.it. [62.149.158.83])
Mon, 17 Aug 2026 22:52:49 -0700 (PDT)
Message-Id: <[email protected]>
A NEW MESSAGE for you #H1695 READ -> withdrawer.carrd.co?
show less
crypto scam spam from std724.phy.lolipop.jp (std724.phy.lolipop.jp. [157.7.105.147])
Mon, 17 Aug 20 ...
show morecrypto scam spam from std724.phy.lolipop.jp (std724.phy.lolipop.jp. [157.7.105.147])
Mon, 17 Aug 2026 03:47:00 -0700 (PDT)
Message-ID: <[email protected]>
You have ONE MESSAGE #XH1418 OPEN - withdrawer.carrd.co?
withdrawer.carrd.co - phishing site (fake coinbase site )
show less
phishing site http://withdrawer.carrd.co/?
The main IP is 104.18.40.34, located in Ascension Island ...
show morephishing site http://withdrawer.carrd.co/?
The main IP is 104.18.40.34, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is withdrawer.carrd.co
TLS certificate: Issued by WE1 on July 14th 2026. Valid for: 3month
Targeting these brands: Coinbase (Crypto Exchange)
2 Outgoing links :
URL: https://rss2.sayler.at/go/y2b403/y274x274?label=subaccount2
Title: RECEIVE MONEY
URL: https://carrd.com/build?ref=auto
Title: Made with Carrd
show less
crypto scam spam from sv12057.xserver.jp (sv12057.xserver.jp. [103.3.2.58])
Mon, 17 Aug 2026 03:24: ...
show morecrypto scam spam from sv12057.xserver.jp (sv12057.xserver.jp. [103.3.2.58])
Mon, 17 Aug 2026 03:24:32 -0700 (PDT)
Message-ID: <[email protected]>
You have ONE MESSAGE โSW8516 READ โค withdrawer.carrd.co?
show less
crypto scam spam Received: from md-in-70.webhostbox.net ([103.50.160.62]:52034 helo=cpwworld.com)
S ...
show morecrypto scam spam Received: from md-in-70.webhostbox.net ([103.50.160.62]:52034 helo=cpwworld.com)
Source-IP: 103.50.160.62
Hi โ You have A NEW MESSAGE โX7649 OPEN -> telegra.ph /Coinbase-08-13f?
show less
crypto scam spam from omta036.useast.a.cloudfilter.net (omta036.useast.a.cloudfilter.net. [44.202.16 ...
show morecrypto scam spam from omta036.useast.a.cloudfilter.net (omta036.useast.a.cloudfilter.net. [44.202.169.35])
Fri, 14 Aug 2026 00:00:11 -0700 (PDT)
Hi You have A NEW MESSAGE โX7649 OPEN -> telegra.ph /Coinbase-08-13f?
show less
crypto scam spam from black.elm.relay.mailchannels.net (black.elm.relay.mailchannels.net. [23.83.212 ...
show morecrypto scam spam from black.elm.relay.mailchannels.net (black.elm.relay.mailchannels.net. [23.83.212.19])
Thu, 13 Aug 2026 23:32:37 -0700 (PDT)
Message-ID: <[email protected]>
Username: www.transfer403.pages.dev - BTC TRANSFER 95965 USDC
show less
crypto scam spam from 127.0.0.1 (tor-exit-48.for-privacy.net [185.220.101.48])
Fri, 14 Aug 2026 13 ...
show morecrypto scam spam from 127.0.0.1 (tor-exit-48.for-privacy.net [185.220.101.48])
Fri, 14 Aug 2026 13:00:11 +0900 (JST)
Please act within the specified timeframe. ACCESS YOUR ACCOUNT https://telegra.ph/Memo-No-yYyf9BKMz-08-12
show less
crypto scam spam from hsmtpd-dty-c1101.xspmail.jp (hsmtpd-dty-c1101.xspmail.jp. [210.130.137.8])
Th ...
show morecrypto scam spam from hsmtpd-dty-c1101.xspmail.jp (hsmtpd-dty-c1101.xspmail.jp. [210.130.137.8])
Thu, 13 Aug 2026 21:00:13 -0700 (PDT)
Message-ID: <[email protected]>
Please act within the specified timeframe. ACCESS YOUR ACCOUNT https://telegra.ph/Memo-No-yYyf9BKMz-08-12
show less
Crypto scam spam from hitechceramic.in/brochure.php for 107.189.6.232
Thu, 13 Aug 2026 04:07:21 -07 ...
show moreCrypto scam spam from hitechceramic.in/brochure.php for 107.189.6.232
Thu, 13 Aug 2026 04:07:21 -0700 (PDT)
(1) MESSAGE for you #K4841 OPEN => linkspree.net/p/you-have-1-new-message-0637af?
show less
phishing spam Received: from [101.36.104.46] (port=55028 helo=1YK35E8R9XF99GZTG)
Thu, 13 Aug 2026 0 ...
show morephishing spam Received: from [101.36.104.46] (port=55028 helo=1YK35E8R9XF99GZTG)
Thu, 13 Aug 2026 02:02:07 -0700 (PDT)
Hey buddy,
Feels like ages since we last spoke, but I just had to get in touch.
So, you wonโt believe this happened last night โ I woke up this morning and checked my account, and there it was: $26,700 sitting right there. ๐ธ
Yeah, not joking โ even Iโm still trying to believe it.
Anyway, remember I told you Iโd share that code once everything went through?
Well, here it is โ your $2000 promo code ๐
๐ GET2000
Just use it when you join, and youโll get $2000 added instantly on the website - Click here https://www-google-com.cdn.ampproject.org/c/s/share.google/OcrhwDhQdaOetjbbW?token=ljnl0y&sessionID=kmeuy&rand=615a1o&ts=1720637480#a453?ey8tq3jz4fmkc8pqux29
Consider it a little bonus from me.
Honestly, this whole thing feels unreal โ maybe itโs just my lucky streak.
Either way, I thought you might get in on it.
Let me know how it goes โ
show less
phishing spam from h6mail.hostdl.com (h6mail.hostdl.com. [116.202.36.217])
Thu, 13 Aug 2026 02:02:0 ...
show morephishing spam from h6mail.hostdl.com (h6mail.hostdl.com. [116.202.36.217])
Thu, 13 Aug 2026 02:02:07 -0700 (PDT)
Hey buddy,
Feels like ages since we last spoke, but I just had to get in touch.
So, you wonโt believe this happened last night โ I woke up this morning and checked my account, and there it was: $26,700 sitting right there. ๐ธ
Yeah, not joking โ even Iโm still trying to believe it.
Anyway, remember I told you Iโd share that code once everything went through?
Well, here it is โ your $2000 promo code ๐
๐ GET2000
Just use it when you join, and youโll get $2000 added instantly on the website - Click here https://www-google-com.cdn.ampproject.org/c/s/share.google/OcrhwDhQdaOetjbbW?token=ljnl0y&sessionID=kmeuy&rand=615a1o&ts=1720637480#a453?ey8tq3jz4fmkc8pqux29
Consider it a little bonus from me.
Honestly, this whole thing feels unreal โ maybe itโs just my lucky streak.
Either way, I thought you might get in on it.
show less
crypto scam spam from std752.phy.lolipop.jp (std752.phy.lolipop.jp. [157.7.105.223])
Thu, 13 Aug 20 ...
show morecrypto scam spam from std752.phy.lolipop.jp (std752.phy.lolipop.jp. [157.7.105.223])
Thu, 13 Aug 2026 00:14:12 -0700 (PDT)
Message-ID: <[email protected]>
A NEW MESSAGE for you #E7452 READ -> linkspree.net/p/you-have-1-new-message-0637af?
show less
crypto scam spam from a9-8.smtp-out.amazonses.com (a9-8.smtp-out.amazonses.com. [54.240.9.8])
Wed, ...
show morecrypto scam spam from a9-8.smtp-out.amazonses.com (a9-8.smtp-out.amazonses.com. [54.240.9.8])
Wed, 12 Aug 2026 05:46:36 -0700 (PDT)
Message-ID: <[email protected]>
You have ONE MESSAGE #P6438 READ -> linkspree.net/p/you-have-1-new-message-0637af?
show less
crypto scam spam from smartdh04-2.aruba.it (smartdh04-2.aruba.it. [62.149.158.77])
Wed, 12 Aug 202 ...
show morecrypto scam spam from smartdh04-2.aruba.it (smartdh04-2.aruba.it. [62.149.158.77])
Wed, 12 Aug 2026 05:11:55 -0700 (PDT)
Message-ID: <[email protected]>
A NEW MESSAGE for you #O2034 OPEN => linkspree.net/p/you-have-1-new-message-0637af?
show less
phishing site (Fake coinbase) https://rss.sayler.at/
97ee7.catex.at 31.59.121.53 Malicious Activit ...
show morephishing site (Fake coinbase) https://rss.sayler.at/
97ee7.catex.at 31.59.121.53 Malicious Activity!
The main IP is 31.59.121.53, located in Paris, France and belongs to AS56971 CGI GLOBAL LIMITED, HK.
The main domain is 97ee7.catex.at. 3mo old TLS certificate: Issued by YR1 on July 8th 2026. Valid for: 3mo.
Your request to withdraw 1.8 BTC from the mining platform is being processed. However, to complete the transaction, you need to verify your identity. Your account has been marked as pending KYC. Without document validation, you cannot access your funds. Please log in to your personal account via the secure link and upload a photo of your passport: https://rss.sayler.at/go/y274w2/z274x264?label=c1208 Verification Team
show less
phishing site (Fake coinbase) https://rss.sayler.at/
97ee7.catex.at
31.59.121.53 Malicious Activ ...
show morephishing site (Fake coinbase) https://rss.sayler.at/
97ee7.catex.at
31.59.121.53 Malicious Activity!
The main IP is 31.59.121.53, located in Paris, France and belongs to AS56971 CGI GLOBAL LIMITED, HK. The main domain is 97ee7.catex.at. 3mo old
TLS certificate: Issued by YR1 on July 8th 2026. Valid for: 3mo.
Redirect Chain
https://rss.sayler.at/go/y274w2/z274x264?
https://97ee7.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTEyO3M6NDoibm9wZCI7czoxMzoicnNzLnNheWxlci5hdCI7czoxOiJvIjtpOjIxMzU7
Your request to withdraw 1.8 BTC from the mining platform is being processed. However, to complete the transaction, you need to verify your identity.
Your account has been marked as pending KYC. Without document validation, you cannot access your funds.
Please log in to your personal account via the secure link and upload a photo of your passport: https://rss.sayler.at/go/y274w2/z274x264?label=c1208
Verification Team
show less
crypto scam spam from www.etailergateway.com.my/index.php for 45.84.107.55
Wed, 12 Aug 2026 01:04:5 ...
show morecrypto scam spam from www.etailergateway.com.my/index.php for 45.84.107.55
Wed, 12 Aug 2026 01:04:54 -0700 (PDT)
ONE MESSAGE for you โI9001 OPEN => linkspree.net/p/you-have-1-new-message-0637af?
show less
crypto scam spam from sharedtransac-p100-i250.d.tsp1-brevo.net (sharedtransac-p100-i250.d.tsp1-brevo ...
show morecrypto scam spam from sharedtransac-p100-i250.d.tsp1-brevo.net (sharedtransac-p100-i250.d.tsp1-brevo.net. [212.146.244.250])
Tue, 11 Aug 2026 23:14:46 -0700 (PDT)
Message-Id: <[email protected]>
You have A NEW MESSAGE #A2100 OPEN ->>> linkspree.net/p/you-have-1-new-message-0637af
show less
crypto scam spam from conges.lk-interactive.fr ([51.178.49.241] helo=SDRXUBTJHH1K4F4IW1CJ0LB5GD)
Tu ...
show morecrypto scam spam from conges.lk-interactive.fr ([51.178.49.241] helo=SDRXUBTJHH1K4F4IW1CJ0LB5GD)
Tue, 11 Aug 2026 22:33:57 -0700 (PDT)
Anyway, remember I told you Iโd hook you up with that bonus once everything went through?
Well, here it is โ your $2000 promo code ๐
๐ GET2000
Just enter it when you get started, and youโll get $2000 added instantly on the website - Click now
Consider it a little thank you from me.
show less
phishing spam from cl05.keurigonline.nl (cl05.keurigonline.nl. [5.22.249.25])
Tue, 11 Aug 2026 22:3 ...
show morephishing spam from cl05.keurigonline.nl (cl05.keurigonline.nl. [5.22.249.25])
Tue, 11 Aug 2026 22:33:57 -0700 (PDT)
Message-Id: <[email protected]>
Anyway, remember I told you Iโd hook you up with that bonus once everything went through?
Well, here it is โ your $2000 promo code ๐
๐ GET2000
Just enter it when you get started, and youโll get $2000 added instantly on the website -
Click now https://www-google-com.cdn.ampproject.org/c/s/share.google/iC0HSJEj3EcImHXUy?id=yy1gwh&token=xnown4f&rand=s6f38&ts=1717960434#x7376?k7iavwvj24jc98dfaep5v
Consider it a little thank you from me.
show less
crypto scam spam from smartcmd0188.aruba.it (smartcmd0188.aruba.it. [62.149.158.88])
Tue, 11 Aug 20 ...
show morecrypto scam spam from smartcmd0188.aruba.it (smartcmd0188.aruba.it. [62.149.158.88])
Tue, 11 Aug 2026 21:07:30 -0700 (PDT)
Message-ID: <[email protected]>
(1) MESSAGE for you #P7366 OPEN => linkspree.net/p/you-have-1-new-message-0637af?
show less