synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇸 103.70.137.133	20 Aug 2025	Received Aug 19, 2025 18:12:18 -0400. Message is a casino/check lure promising "$7,389.85" and "380 ... show more Received Aug 19, 2025 18:12:18 -0400. Message is a casino/check lure promising "$7,389.85" and "380 free spins," pushing sign-up via redirect links. Unsolicited bulk promotion; deceptive subject and claims. SPF: pass (kjkl.xkcj.writtees.de @ 103.70.137.133). DKIM: permerror for f847f9.9w16m2.tw8g6f.us. DMARC: none observed; From domain not aligned. Forged/misleading headers and DKIM failure violate RFC 6376/7489; header format issues breach RFC 5322. Violates CAN-SPAM (15 U.S.C. §7701 et seq.). Sending IP: 103.70.137.133 (rapidblazenow.nl). Network: THE VALUE HOSTED LLC. Mail server IP: 103.70.137.133. Abuse: [email protected]. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 45.61.62.41	20 Aug 2025	Received Tue, 19 Aug 2025 14:32:08 PDT. Message impersonates Lowe’s rewards and pushes a “Get Your C ... show more Received Tue, 19 Aug 2025 14:32:08 PDT. Message impersonates Lowe’s rewards and pushes a “Get Your Cooler” lure via a DigitalOcean Spaces link. Deceptive commercial content intended to harvest clicks/credentials, not a legitimate account notice. Sending client IP: 45.61.62.41 (mail.migua.me) via Gmail SMTP AUTH; outbound mail server IP: 209.85.220.41 (mail-sor-f41.google.com). SPF, DKIM, and DMARC all PASS for gmail.com despite the abuse. The Date header is grossly malformed (“Thu, 03 Jun 9474 10:02:45 +5624”), violating RFC 5322. Spam continues despite prior complaints; the host appears unresponsive. Likely violates the CAN-SPAM Act (15 U.S.C. §§ 7701–7713) for misleading headers/subject and may implicate 18 U.S.C. § 1343 when used for phishing. IP owner contacts: Cloud Web Manage/Kamatera for 45.61.62.41 — [email protected]; show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 67.220.94.240	19 Aug 2025	Phishing/spam received Tue, 19 Aug 2025 14:35:46 PDT. Message impersonates “Gmail Support Team” with ... show more Phishing/spam received Tue, 19 Aug 2025 14:35:46 PDT. Message impersonates “Gmail Support Team” with subject “Your Subscription will be Closed [Final Warning]”, aiming to scare the user into clicking “Secure Your Device”. Technical: sending IP 67.220.94.240 (dickens.servewrap.me.uk); intermediate MTA 173.228.155.53 (njmta-53.sailthru.com). SPF: pass for [email protected]; DKIM: permerror (no key for d=8h52fh.n006m8.0skmr8.us); DMARC: no result observed and From-domain not aligned with SPF—would not pass policy. From-domain branding is deceptive. Host/abuse: IP owner objx.net, LLC — [email protected]. Laws/RFCs: deceptive commercial email and brand impersonation violate CAN-SPAM (15 U.S.C. §7701 et seq.) and may constitute wire fraud (18 U.S.C. §1343); DKIM failure per RFC 6376 and DMARC absent/misaligned per RFC 7489; misleading headers contravene RFC 5322. (Owner/abuse contact for 67.220.64.0/19 “OBJX / objx.net, LLC”: [email protected]. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 209.141.39.45	19 Aug 2025	Received on Aug 19, 2025 14:07:07 -0700 (PDT). Bulk HTML lure advertising “free Omaha Steaks,” linki ... show more Received on Aug 19, 2025 14:07:07 -0700 (PDT). Bulk HTML lure advertising “free Omaha Steaks,” linking to obfuscated storage-based pages and urging survey clicks. Headers show bulk/precedence and manipulative subject that reuses the recipient’s name. Content attempts to drive traffic off-site and solicit engagement with deceptive rewards. Auth results: SPF pass for return@… via 209.141.39.45; DKIM pass for mz8k5erzfrx64.folly.ing.pare.uk.com; DMARC result not shown/unaligned. Multiple header anomalies (forged X-Original-Sender, misleading X-Google-Sender-Delegation, odd List-ID) and weak rsa-sha1 DKIM contravene best practices (RFC 5322/8301; DMARC RFC 7489 absent). Sending IP: 209.141.39.45 (rDNS ip4.static.sl-reverse.com / bergstrom.avvyglow.com). Also seen in path: mta8132.mp2200.com [162.247.118.132]. Network owner for 209.141.39.45: FranTech Solutions (PONYNET); abuse: [email protected]. Spam complaints to this address BOUNCE as UNDELIVERABLE!!! show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 198.2.142.77	19 Aug 2025	Received Tue, Aug 19, 2025 at 13:09:39 PDT (20:09:39 UTC). Unsolicited bulk marketing message delive ... show more Received Tue, Aug 19, 2025 at 13:09:39 PDT (20:09:39 UTC). Unsolicited bulk marketing message delivered via a Mailchimp relay (mail77.atl261.mcdlv.net / 198.2.142.77) using the subject “Rick Case Connect: August Edition.” Content promotes hurricane-season offers: complimentary vehicle multi-point inspection, service scheduling, Honda generators, and a downloadable “Hurricane Guide,” with numerous tracking/redirect links on *.list-manage.com and visible campaign identifiers (List-ID / Feedback-ID). Authentication shows no spoofing: SPF=pass for the Mailchimp sender (198.2.142.77), DKIM=pass for gmail.mcsv.net and rickcasemail.com, DMARC=pass for rickcasemail.com (policy REJECT). Despite one-click List-Unsubscribe headers, this was unsolicited commercial email and appears to be part of a bulk campaign. Please review and curb further unwanted mail from this sender/IP. show less	Phishing Web Spam Email Spam
🇺🇸 52.54.164.64	19 Aug 2025	Unsolicited commercial email received 2025-08-19 13:08:37 UTC. Message markets “Smarter content buil ... show more Unsolicited commercial email received 2025-08-19 13:08:37 UTC. Message markets “Smarter content built for social,” sent via Google to Microsoft 365. Authenticated client connected to smtp.gmail.com from 52.54.164.64 (EC2) which then relayed through mail-qt1-x833.google.com (2607:f8b0:4864:20::833). Headers show SPF=pass for levitatecuratesvideos.com, DKIM=pass (d=levitatecuratesvideos.com), DMARC=pass; no header spoofing observed. Despite prior complaints, these unsolicited messages continue, indicating the host has not curbed the abuse. Likely CAN-SPAM violations (15 U.S.C. §7701 et seq.) if sent without consent/required disclosures (clear opt-out and physical address). No obvious RFC 5321/5322 violations in the trace; request investigation and termination of abusive use of the above IPs and any related accounts. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 216.250.124.116	19 Aug 2025	Received 2025-08-19 12:38 UTC. Unsolicited commercial email titled “Re: information technology & ser ... show more Received 2025-08-19 12:38 UTC. Unsolicited commercial email titled “Re: information technology & services articles + Sawgrass Ford” arrived via Gmail relay. Earliest hop shows authenticated client “revgen-ionos-sender-01” (ip216-250-124-116.pbiaas.com) connecting to smtp.gmail.com (ESMTPSA), then delivered by mail-il1-x135.google.com to my mailbox. Authentication: SPF=pass, DKIM=pass (clearviaz-co.20230601.gappssmtp.com), DMARC=pass (clearviaz.co). Content is cold outreach/marketing using deceptive “Re:” to simulate a prior thread; no prior relationship or consent. Violates anti-spam law (CAN-SPAM, 15 U.S.C. §7701 et seq.) due to unsolicited commercial content and misleading subject. No obvious RFC 5321/5322 syntax errors observed. Prior complaints to the host have not stopped this campaign; spam continues. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 198.244.50.68	19 Aug 2025	Received Aug 19, 2025 at 08:27 UTC. Unsolicited commercial email promoting “Certified Renewables” wi ... show more Received Aug 19, 2025 at 08:27 UTC. Unsolicited commercial email promoting “Certified Renewables” with subject “Avoid Wealth-Based Energy Charges — Save Up to 70%”. Sent via Mailgun infrastructure (198.244.50.68, a68.a926d550.use4.send.mailgun.net) on behalf of send.certifiedrenewables.com; Microsoft marked SCL=9. Authentication: SPF=pass, DKIM=pass (d=send.certifiedrenewables.com), DMARC=pass (from=certifiedrenewables.com) — not a spoof, but bulk UCE. Content pushes energy-cost offers and tracking/unsubscribe links; recipient did not consent. This likely violates anti-spam laws (CAN-SPAM, 15 U.S.C. §7701 et seq.) if sent without consent or if opt-out is ignored. No clear RFC 5321/5322 violations seen. Headers forwarded to the host. Host appears not to care as the spam continues. Host/Abuse: Mailgun Technologies, Inc. (AS396479); [email protected]; +1-888-571-8972. show less	Fraud Orders Phishing Web Spam Email Spam
🇺🇸 103.70.137.129	19 Aug 2025	Received Aug 19, 2025 at 11:07:26 PDT. Message impersonates “Gmail Support Team” to threaten account ... show more Received Aug 19, 2025 at 11:07:26 PDT. Message impersonates “Gmail Support Team” to threaten account/subscription closure and push a “Secure Your Device”/unsubscribe link hosted on storage.googleapis.com—classic credential-harvest lure. Header auth: SPF PASS for vaccinational.org via 103.70.137.129; DKIM PERMERROR (no key published for s=default at srbmew.qpiafr.vcb63r.us, per RFC 6376); From-domain and SPF-auth domain misaligned, so DMARC would not pass per RFC 7489. Deceptive headers/branding and actionable scare tactics violate the U.S. CAN-SPAM Act (15 U.S.C. §7701 et seq.) and constitute attempted wire fraud (18 U.S.C. §1343). Origin IP 103.70.137.129 is on THE VALUE HOSTED LLC (AS399502). Abuse: [email protected] , phone +92 51 447 1657. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 81.7.11.48	19 Aug 2025	This is a deceptive promotional message masquerading as a legitimate mobile casino offer. The "From" ... show more This is a deceptive promotional message masquerading as a legitimate mobile casino offer. The "From" field impersonated the recipient’s name, presenting as false. The subject touted “Generous bonuses and huge winnings are waiting for you,” yet the body contains garbled text and inscrutable codes instead of any meaningful content. The embedded unsubscribe and internal links appear suspicious and potentially malicious, lacking proper formatting or branding consistency. This indicates intent to spam, confuse, and possibly phish or defraud the recipient. The response lacks personalization, opt-in confirmation, or authenticity, reinforcing its illegitimacy. This unsolicited message may breach anti-spam laws such as the CAN-SPAM Act (false header info, deceptive subject, lack of opt-out clarity). In addition, it violates RFC 5322 (header integrity, From field spoofing), RFC 6376 (invalid DKIM signature), and likely fails DMARC alignment practices (RFC 7489). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 192.210.198.18	19 Aug 2025	Received Tue, Aug 19, 2025 07:50:36 EDT. Unsolicited gambling/casino promo in German using the displ ... show more Received Tue, Aug 19, 2025 07:50:36 EDT. Unsolicited gambling/casino promo in German using the display name “CashApp,” linking to Google Cloud Storage landing pages, and a Reply-To at a .uic.edu subdomain; body packed with random text to evade filters. Headers show source IP 192.210.198.18 (syn-192-210-198-018.biz.spectrum.com) via labaalief.com. SPF: pass for acidic-sophisticated.high-pitched.thropological.com; DKIM: permerror (no key) for bbztzixfugatflbwyvofredq.com; DMARC: no result shown/alignment not established in header results. Likely violates CAN-SPAM (15 U.S.C. §7704—false/misleading headers/deceptive ad) and may constitute wire fraud (18 U.S.C. §1343). RFC issues: 5322 (misleading From), 6376 (DKIM failure), 7489 (DMARC policy/alignment). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 76.223.141.173	19 Aug 2025	Received Mon, 18 Aug 2025 14:33:37 -0700 (PDT). Unsolicited bulk advertising for a “First American P ... show more Received Mon, 18 Aug 2025 14:33:37 -0700 (PDT). Unsolicited bulk advertising for a “First American Pope” $2 bill sent via Amazon SES. Sending MTA/IP: c141-173.smtp-out.amazonses.com (76.223.141.173). Message promotes commercial product with tracking links and affiliate-style “partner spotlights.” Auth results: SPF pass, DKIM pass (amazonses.com and your.bankstreetjournal.com), DMARC pass (header.from=bankstreetjournal.com). This appears to be abuse of an AWS SES resource to deliver unwanted ads. Likely CAN-SPAM violations (15 U.S.C. §7701 et seq.; deceptive/unsolicited advertising, manipulative subject). No clear RFC 5321/5322 violations observed. Hosting/owner: Amazon Web Services (Amazon.com, Inc.). Abuse contact: [email protected]. Please investigate and terminate the sender. show less	Phishing Web Spam Email Spam
🇺🇸 94.72.163.58	19 Aug 2025	Received Tue, Aug 19, 2025 02:00:14 PDT. Malicious 'Gmail Support' account-termination lure using fa ... show more Received Tue, Aug 19, 2025 02:00:14 PDT. Malicious 'Gmail Support' account-termination lure using fake urgency and multiple redirect links; subject asserts subscription closure. Body has random strings and obfuscated HTML to evade filters. Connecting host: 94.72.163.58 (94-72-163-58.static.hvvc.us). Prior complaints to the host; spam continues. Auth: SPF pass for hydrolytecost.com; DKIM permerror for 60nqh9.us; DMARC alignment fails (From=60nqh9.us, MailFrom=hydrolytecost.com). Intermediate hop observed: njmta-53.sailthru.com 173.228.155.53. Content pushes 'secure your device'/'account console' clicks aimed at credential theft. Violations: CAN-SPAM (15 USC 7704) and wire fraud (18 USC 1343). RFCs: 7489 (DMARC fail), 6376 (DKIM permerror), 7208 alignment; deceptive brand impersonation. Please investigate and terminate abuse; provider appears unresponsive as spam persists. IP host: Hivelocity (HVVC). Abuse: [email protected]. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.102.106.145	19 Aug 2025	Received Mon, Aug 18, 2025 15:52:15 PDT via bradtke.designatin.com (27.102.106.145). Unsolicited cas ... show more Received Mon, Aug 18, 2025 15:52:15 PDT via bradtke.designatin.com (27.102.106.145). Unsolicited casino promo “400% Bonus up to €2000 + 145 Free Spins” with obfuscated links and base64 HTML; sent via Sailthru chain nj1-madbrick.flt → njmta-53.sailthru.com (173.228.155.53). Auth: SPF pass for [email protected] via 27.102.106.145; DKIM permerror (no key) for ctun4e.dbgb6o.56hnll.us; no DMARC result/alignment seen. Misuses multipart/report (delivery-status) for ads (RFC 3464); broken DKIM violates RFC 6376. Header/body identities inconsistent. Unsolicited commercial email; likely violates CAN-SPAM (15 U.S.C. §7701). Prior complaints to the host have not stopped the spam. Network owners: 27.102.106.145 = DAOU TECHNOLOGY (abuse: [email protected], [email protected]); show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 209.141.43.190	18 Aug 2025	WordFence report from WordPresss: 209.141.43.190 (United States) Blocked for SureTriggers <= 1.0.7 ... show more WordFence report from WordPresss: 209.141.43.190 (United States) Blocked for SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation show less	Hacking Brute-Force Bad Web Bot
🇺🇸 2a0d:5600:24:2b7::e012	18 Aug 2025	11:17am 2a0d:5600:24:2b7::e012 (United States) Blocked for Directory Traversal in query string: ... show more 11:17am 2a0d:5600:24:2b7::e012 (United States) Blocked for Directory Traversal in query string: s = ../\think\Container/invokefunction show less	Hacking Brute-Force Bad Web Bot
🇮🇪 52.169.25.28	18 Aug 2025	128 WordPress login failure attempts.	Hacking Brute-Force Bad Web Bot
🇫🇷 163.172.81.246	18 Aug 2025	Received Mon, Aug 18, 2025 12:09:56 PDT. Message impersonates “CashApp,” claims a $22,000 credit, us ... show more Received Mon, Aug 18, 2025 12:09:56 PDT. Message impersonates “CashApp,” claims a $22,000 credit, uses deceptive Unicode/subject and redirects to storage.googleapis.com landing pages plus gibberish filler to evade filters. Delivered to Gmail from 209.126.104.41 (condor2865.startdedicated.com / outtrail.us.com). Auth results: SPF PASS for envelope-from access-weebly.mail-check.info.replacesla.info; DKIM: none; DMARC: alignment FAIL (From domain ah7ltp.us not aligned with SPF domain). Likely violations: CAN-SPAM (15 U.S.C. §7701 et seq.—misleading subject/headers, unsolicited, no valid sender address) and attempted wire fraud/phishing (18 U.S.C. §1343). RFC issues: 5322 header integrity/misleading fields; DMARC per RFC 7489 not aligned; SPF per RFC 7208 used on unrelated domain. All headers reported to the mail server’s host; spam persists and the host appears unresponsive to complaints. Host/abuse: velia.net (GoDaddy), phone +49 221 429 143, email [email protected]. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 158.220.108.22	18 Aug 2025	Received: Mon, Aug 18, 2025 09:10:02 PDT. Phishing/impersonation email claiming “iCloud” storage is ... show more Received: Mon, Aug 18, 2025 09:10:02 PDT. Phishing/impersonation email claiming “iCloud” storage is full and urging “GET MORE STORAGE,” with redirect links hosted on Google Cloud Storage. Message sent via goldner.undomesti.com [158.220.108.22]. Auth: SPF PASS for [email protected] via 158.220.108.22; DKIM and DMARC not shown/aligned. Header/RFC issues: bogus Content-Transfer-Encoding “8bit+”; malformed Sender field (no address); Gmail inserted “SMTPIN_ADDED_BROKEN” Message-ID; visible From domain mismatches envelope MAIL FROM (likely DMARC fail/absent). This is deceptive commercial email / credential-harvesting, potentially violating CAN-SPAM (15 U.S.C. §7704) and U.S. wire fraud statute (18 U.S.C. §1343). All headers are reported to the mail server’s hosting company. Host / abuse contacts (owner of 158.220.108.0/24): Contabo GmbH (AS51167). Abuse email: [email protected] (per RIPE remarks). Main phone (Contabo): +49 (89) 3564717-71. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 20.51.234.233	18 Aug 2025	20.51.234.233 (United States) Blocked for Exchange Proxy(Not?)Shell CVE-2022–41040 and CVE-2022–410 ... show more 20.51.234.233 (United States) Blocked for Exchange Proxy(Not?)Shell CVE-2022–41040 and CVE-2022–41082 show less	Hacking Brute-Force Bad Web Bot
🇺🇸 40.119.33.98	18 Aug 2025	40.119.33.98 (United States) Blocked for Exchange Proxy(Not?)Shell CVE-2022–41040 and CVE-2022–4108 ... show more 40.119.33.98 (United States) Blocked for Exchange Proxy(Not?)Shell CVE-2022–41040 and CVE-2022–41082 show less	Hacking Brute-Force Bad Web Bot
🇺🇸 5.175.234.59	18 Aug 2025	5.175.234.59 (Germany) Blocked for WordPress New Install File Probing	Hacking Brute-Force Bad Web Bot
🇫🇷 85.204.70.94	18 Aug 2025	40 WordPress failed login attempts.	Hacking Brute-Force Bad Web Bot
🇸🇬 45.125.194.93	18 Aug 2025	Received Aug 18, 2025 at 10:53:14 −0400. Message is bulk phishing/spam promising an “$8,000” payout ... show more Received Aug 18, 2025 at 10:53:14 −0400. Message is bulk phishing/spam promising an “$8,000” payout with urgent CTA; HTML redirects via Google storage to obfuscated pages; bogus newsletter layout with random strings; deceptive display name “💲Congratulations💲” from uba313.oy2i45.hln9j1.us. Delivered via soondcarabwa.club [45.125.194.93]; Return-Path uses paciformulater.net. Auth: SPF PASS (paciformulater.net); DKIM PERMERROR (no key) for uba313.oy2i45.hln9j1.us; DMARC not shown and fails alignment (header.from ≠ SPF/DKIM domains). Laws/RFCs: likely violates CAN-SPAM (15 U.S.C. §7701 et seq.—deceptive subject, no consent, sham unsubscribe) and constitutes phishing/wire-fraud attempt (18 U.S.C. §1343). RFC nonconformance: DKIM (RFC6376) permerror, DMARC alignment fail (RFC7489), misuse of multipart/report DSN (RFC3464). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 5.39.31.122	18 Aug 2025	Received: Aug 18, 2025 09:21 -0400. Message impersonates “Gmail Support Team” and threatens account/ ... show more Received: Aug 18, 2025 09:21 -0400. Message impersonates “Gmail Support Team” and threatens account/subscription closure with a “Final Warning,” pushing the user to click “Secure Your Device/Unsubscribe.” Headers show SMTP from 5.39.31.122 (workouttips.net); Return-Path is [email protected] while From is a random .us domain—mismatch. SPF: PASS for stone-wall… (5.39.31.122) but not aligned with From; DKIM: none; DMARC: alignment fails/none observed. Content includes obfuscated filler to evade filters. This appears to violate CAN-SPAM (deceptive headers/subject, noncompliant opt-out) and contravenes RFC 5322 (misleading From), RFC 7489 (DMARC alignment), RFC 6376 (no DKIM). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host