Received 2025-08-18 04:48:22 PDT. Source IP 162.213.197.45 (162-213-197-45.static.hvvc.us) delivered ...
show moreReceived 2025-08-18 04:48:22 PDT. Source IP 162.213.197.45 (162-213-197-45.static.hvvc.us) delivered a German-language casino/'direct transfer $2,000' lure via a Google Cloud Storage link to 'dexter.html' with a PHP fragment. Body is padded with random newsletters/login dumps (obfuscation). The From field falsely used the recipient's name; Reply-To is at a different domain (uic.edu). Auth results: SPF=pass for a disposable subdomain; DKIM=permerror (no key); DMARC=none/not aligned; ARC cv=none. Violations: CAN-SPAM (15 USC 7701 et seq.) and wire fraud (18 USC 1343); the credential-harvesting link may also implicate CFAA (18 USC 1030). RFC breaches: 5321/5322 (forged headers), 6376 (DKIM), 7489 (DMARC). Hosting: Hivelocity, Inc. (AS29802) — [email protected], +1-888-869-4678.
show less
Received on Aug 17, 2025 at 23:56:34 -0400. Unsolicited casino promo (“400% Bonus up to €2000 + 145 ...
show moreReceived on Aug 17, 2025 at 23:56:34 -0400. Unsolicited casino promo (“400% Bonus up to €2000 + 145 Free Spins”) with obfuscated HTML/random strings and pressure to click/unsubscribe. From header used the recipient’s name falsely. Sending host: fredestry.online [103.252.44.84]. Also seen in path: njmta-53.sailthru.com [173.228.155.53].Auth results: SPF pass for authentication-email.aweber.com.congressure.org (non-aligned); DKIM permerror (no key) for z91tlp.48l9j1.3ql6gv.us; DMARC not present/likely fails alignment. CAN-SPAM (15 U.S.C. §7704: deceptive headers/marketing) and breaches RFC 5322 (From misrep) and RFC 7489 (DMARC alignment).
show less
Received on Aug 17, 2025 16:24:37 PDT by mx.google.com. Unsolicited bulk advertising for “Mixedesire ...
show moreReceived on Aug 17, 2025 16:24:37 PDT by mx.google.com. Unsolicited bulk advertising for “Mixedesire” adult products with aggressive sales language and many tracking links; sent as a mass-marketing blast (Precedence: bulk, List-Unsubscribe present) without my consent.
Sending IP: 149.72.154.99; mail server: o14.mailer.shopify.com (Twilio SendGrid). Mail server IP: 149.72.154.99. Auth: SPF=pass, DKIM=pass (g.shopifyemail.com; sendgrid.info), DMARC=pass. Despite prior complaints, spam from this source continues; the host appears indifferent.
This may violate CAN-SPAM Act §5 (15 U.S.C. §7704) as unsolicited commercial email and deceptive routing if applicable; no RFC 5321/5322 authentication violations noted. Please investigate and terminate abuse. Abuse contact: [email protected]. All headers are provided to the host.
show less
Received Sun, 17 Aug 2025 16:35:38 -0400. Casino/bonus promotion disguised as “Top Stories of the Da ...
show moreReceived Sun, 17 Aug 2025 16:35:38 -0400. Casino/bonus promotion disguised as “Top Stories of the Day,” with deceptive links and obfuscated HTML. The “From” display name impersonates the recipient (false display name).
Sending IP: 192.210.198.20 (klein.echoridgenovacraft.org.uk / 14.c6.d2c0.ip4.static.sl-reverse.com). Additional header hop: 173.228.155.53 (njmta-53.sailthru.com). SPF: pass. DKIM: permerror (no key found). DMARC: none/absent.
Violates CAN-SPAM (15 U.S.C. §7701 et seq.) via deceptive headers/subject and impersonation; also violates header integrity (RFC 5322 semantics) and misuses multipart/report (RFC 6522). Reported to host AS36352 HostPapa/ColoCrossing; abuse: [email protected] (alt: [email protected]). Prior complaints ignored; spam persists.
I sent tons of mail headers to these emails and they never reply back with any remedy.
show less
Received on Aug 17, 2025 at 15:52 EDT. Message promoted an online casino (“BubblesBet”) with claims ...
show moreReceived on Aug 17, 2025 at 15:52 EDT. Message promoted an online casino (“BubblesBet”) with claims of a 400% deposit bonus and 100 free spins and multiple redirect links. Delivered from discussel.net [50.2.188.218] to Google’s MX. Subject line used the recipient’s name to entice engagement.
Auth results: SPF=pass for access-weebly.mail-check.info.ignoregonting.com via 50.2.188.218; no DKIM signature present; no DMARC result/record seen, so no alignment. HTML body lacks a physical postal address and shows a non-functional/untrusted unsubscribe link.
Likely CAN-SPAM violations (15 U.S.C. §7701 et seq.): deceptive header/subject, no physical address, ineffective opt-out. No explicit SMTP RFC violations evident. Source appears to be Eonix Corporation/ServerHub; report abuse to [email protected]. Ongoing spam persists from this host despite complaints.
show less
Unsolicited gambling promo received Aug 17, 2025 at 14:59 -0400. Subject “100% up to $1,000 + 200 fr ...
show moreUnsolicited gambling promo received Aug 17, 2025 at 14:59 -0400. Subject “100% up to $1,000 + 200 free spins.” Delivered from 94.72.161.218 (94-72-161-218.static.hvvc.us / turboblazefusion.com). Additional hop observed: 173.228.155.53 (njmta-53.sailthru.com).
Auth: SPF=PASS for access-weebly.mail-check.info.ignoregonting.com (94.72.161.218); DKIM: none; DMARC: none shown (alignment cannot be verified). From uses random subdomain and misleading display name (“Congrat”); message disguised as multipart/report (DSN) with obfuscated HTML and junk text to evade filters.
Likely violates CAN-SPAM (15 U.S.C. §7701 et seq.) via unsolicited commercial email and deceptive headers; misuse of DSN format contravenes RFC 3462/3464; header formatting inconsistent with RFC 5322; DMARC best practices per RFC 7489 ignored. Host/net owner appears to be Hivelocity (hvvc.us). Abuse: [email protected]. All headers reported to the host; ongoing spam suggests they disregard complaints.
show less
Received 2025-08-17 14:02:30 -0400. Unsolicited casino promo (“your money is waiting”) delivered via ...
show moreReceived 2025-08-17 14:02:30 -0400. Unsolicited casino promo (“your money is waiting”) delivered via renaissanition.com.de [85.117.243.241] — headers also show Sailthru hop njmta-53.sailthru.com [173.228.155.53]. Links use obfuscated redirects; subject engineered for urgent clicks.
Auth: SPF PASS for access-weebly.mail-check.info.ignoregonting.com using 85.117.243.241. No valid DKIM. DMARC absent or not aligned. Declares multipart/report (report-type=delivery-status) while carrying marketing HTML — deceptive headering and content-type misuse, violating RFC 5322/2045/6522.
Violations: CAN-SPAM (15 U.S.C. §7704) for deceptive subject/headers and unsolicited marketing lacking a clear opt-out/physical address. Network owners: HOSTPERL (AS151612) for 85.117.243.241 — [email protected]; intermediary NYI for 173.228.155.53 — [email protected]. Prior complaints ignored; spam persists. Please investigate and suspend the source.
show less
Received Sun, 17 Aug 2025 02:16:02 PDT. Scam “€2,000 payment / account verification” lure with track ...
show moreReceived Sun, 17 Aug 2025 02:16:02 PDT. Scam “€2,000 payment / account verification” lure with tracking links and junk HTML. Aims to harvest credentials. The From header falsely used the recipient’s name. Unsolicited; recurring campaign.
Auth: SPF=pass for an unrelated MAILFROM (vito-corleone2.sealed-email.certified-mail.auth.gov.us.electuation.uk.net); DKIM=permerror for the visible From domain; DMARC=fail (no aligned SPF/DKIM). Sending IP/host: 192.210.198.19 (ruecker.echoridgenovacraft.org.uk).
Host: HostPapa/ColoCrossing (AS36352). Ongoing spam shows prior complaints ignored. Violations: CAN-SPAM, indicators of 18 U.S.C. §1343, RFC 5322/5321 (headers), 6376 (DKIM), 7489 (DMARC), 7208 (SPF misalignment). Please investigate and suspend the source. Abuse: [email protected]; [email protected].
show less
Received: Sun, 17 Aug 2025 02:10:57 −0700 (PDT). Delivered via aufderhar.tuscattery.live [45.64.216. ...
show moreReceived: Sun, 17 Aug 2025 02:10:57 −0700 (PDT). Delivered via aufderhar.tuscattery.live [45.64.216.115] to Google MX. Source net: MegaHostZone (AS132563). Abuse: [email protected].
Content: phishing/lure email claiming a “direct deposit of €2,000” with “confirm/payment” links, random codes, and a mismatched Reply-To at uic.edu. Multiple unrelated promo text/HTML blobs indicate bulk template spam; no prior relationship with sender.
Auth: SPF pass for apparenk.org; DKIM none; DMARC none/alignment fail (SPF-auth domain doesn’t match From). Deceptive subject/identities likely violate CAN-SPAM (15 U.S.C. §7701 et seq.) and 18 U.S.C. §1343 (wire fraud); headers/identity handling deviate from RFC 5322/6854 norms.
show less
Received Sat, 16 Aug 2025 18:25:20 PDT. Phishing email impersonates “Gmail Support,” claims the mail ...
show moreReceived Sat, 16 Aug 2025 18:25:20 PDT. Phishing email impersonates “Gmail Support,” claims the mailbox subscription will be closed (“Final Warning”), and urges a button click. Body contains junk base64-like text and a fake account table—classic social engineering.
Auth: SPF pass for [email protected] via 23.111.154.10; DKIM permerror (no key) for t958kw.144xbu.2qixki.us; no DMARC result shown and domains misaligned; ARC cv=none. Sending IP at Gmail: 23.111.154.10 (paintainly.co.uk). Additional MTA seen: 173.228.155.53 (njmta-53.sailthru.com).
Violations: CAN-SPAM (15 U.S.C. §7704: deceptive subject/misleading headers), potential wire fraud (18 U.S.C. §1343), RFC 5321/5322 header integrity, and DMARC alignment (RFC 7489). Network/abuse: 23.111.154.10 → HIVELOCITY, [email protected].
show less
Why do I keep getting endless spam from sendthru? I've sent you several emails so far and not heard ...
show moreWhy do I keep getting endless spam from sendthru? I've sent you several emails so far and not heard a single reply back. Why? I supply all of the headers of these spams and it all seems like it's going to a black hole. [email protected] bounces back as undeliverable when reporting it.
Received Aug 16, 2025 15:42:35 -0700 (PDT). Unsolicited auto-warranty ad (“CarShield”) with obfuscated tracking/landing links (Google Cloud Storage/tinyurl) and a mass-mail footer. Headers show send path abusing unrelated domains and list recipients not matching the “To:” line.
Sending IP seen by Gmail: 209.141.34.229 (EHLO “baniacms.com”, rDNS libetwitt.liberation.fr). Additional MTA in chain: 173.228.155.53 (njmta-53.sailthru.com). Auth: SPF pass for mailfrom=www.n4344.com; no DKIM; DMARC fails/unaligned with header From. Materially deceptive headers and domain misalignment violate CAN-SPAM (15 U.S.C. §7704) and RFC 5321/5322; DMARC per RFC 7489.
Host/owner of 209.141.34.229: FranTech Solutions (AS53667).
show less
Received on Aug 16, 2025 at 17:08:07 -0400 (EDT). Message is a casino promotion (“Claim €2000 Bonus ...
show moreReceived on Aug 16, 2025 at 17:08:07 -0400 (EDT). Message is a casino promotion (“Claim €2000 Bonus and 145 Free Spins”) with obfuscated content/links and bulk formatting. The From field used the recipient’s name falsely. Continues a pattern of unwanted mail despite prior complaints to the host.
Auth results: SPF PASS via 27.255.77.85 (howell.aposternal.com) for a throwaway subdomain; no DKIM present; no DMARC result shown. Sending IP: 27.255.77.85; upstream relay observed: 173.228.155.53 (njmta-53.sailthru.com). Network owner for 27.255.77.85: HOSTCENTER (AS45382). Host abuse contact: [email protected] (relay abuse: [email protected]).
Likely violates CAN-SPAM (15 U.S.C. §7701 et seq.) due to deceptive headers/unsolicited advertising. Non-compliant MIME type: message uses multipart/report reserved for DSNs (RFC 6522/3462). Please investigate and terminate the abusive source.
show less
Received Aug 16, 2025 11:58:24 PDT. Accepted from howell.aposternal.com [27.255.77.85]; prior hop nj ...
show moreReceived Aug 16, 2025 11:58:24 PDT. Accepted from howell.aposternal.com [27.255.77.85]; prior hop njmta-53.sailthru.com [173.228.155.53]. 27.255.77.85 operated by Hostcenter/EhostIDC.
Content: unsolicited bulk mail mimicking a “Storage Capacity Reminder/How Much Space Do You Have Left?” with scare text, an “Increase Storage” button, and filler gibberish. Declares Content-Type multipart/report (delivery-status) while delivering marketing/phish content.
Auth: SPF=pass for MAIL FROM email-recovery.mail-check.info.airporate.ch via 27.255.77.85; DKIM=none; DMARC=none. RFC issues: misuse of multipart/report (RFC 6522/3464) and a missing/forged Message-ID added by Gmail (RFC 5322). Likely CAN-SPAM (15 U.S.C. §7701 et seq.) violations. Despite complaints, spam continues and the host appears unresponsive. Report to: [email protected], [email protected], [email protected], [email protected].
show less
Received Sat, 16 Aug 2025 11:14:56 PDT. Unsolicited promotional email pushing “$8k by Monday morning ...
show moreReceived Sat, 16 Aug 2025 11:14:56 PDT. Unsolicited promotional email pushing “$8k by Monday morning” scheme from “David Rodriguez | WOT,” linking through Iterable/wealthoftrade tracking and multiple “partner” ads (political clickbait, fear-based finance pitches). Message uses exaggerated income claims and manipulative urgency to lure to videos; ongoing waves continue despite prior complaints.Technical: sending MTA a73-23.smtp-out.amazonses.com (54.240.73.23, Amazon SES). SPF: pass; DKIM: pass (discover.wealthoftrade.com; amazonses.com); DMARC: not shown in header. Host: Amazon Web Services (SES).
show less
Received on 2025-08-16 12:56:29 -0400. Subject “Please Check Your Account.” Message is bulk “multipa ...
show moreReceived on 2025-08-16 12:56:29 -0400. Subject “Please Check Your Account.” Message is bulk “multipart/report” posing as an account alert; body pushes a “Click_Here” lure and random strings to evade filters. Sending IP: 162.211.120.43 via bechtelar.willica.net / njmta-53.sailthru.com; received by mx.google.com. From field uses the recipient’s name falsely.
Auth: SPF pass for ayav.net (162.211.120.43) but not aligned with From domain (smhutychjeyam.us). DKIM fail for facebook.uybzwzwe.reachesbeast.com.de. DMARC not shown; alignment would fail. This violates CAN-SPAM (15 U.S.C. §7704: misleading headers/deceptive routing, ineffective unsubscribe) and contradicts RFC 5321/5322 header integrity practices.
Host/owner of 162.211.120.43: velia.net (AS30083). Abuse: [email protected]. Repeated complaints ignored and spam continues unabated, indicating the host cares nothing about remediation.
show less
The 8th spam I have received from this IP.
Received on Aug 16, 2025 at 08:37:31 -0700 (PDT). Unso ...
show moreThe 8th spam I have received from this IP.
Received on Aug 16, 2025 at 08:37:31 -0700 (PDT). Unsolicited commercial email promoting weight-loss (“MyStart”) with embedded tracking/redirect links and heavy obfuscated HTML/garbage text to evade filters. Headers show chain inconsistencies and reused MTA lines unrelated to the recipient.
Auth results: SPF pass for whh6655.com (178.162.185.71) but misaligned with visible From xszf41ooud.us; DKIM: none/absent; DMARC: not present or failing alignment. Sending IP: 178.162.185.71 (barton.advanoalthcare.com/libetwitt.liberation.fr). Also observed hop: 173.228.155.53 (njmta-53.sailthru.com).
Violations: CAN-SPAM (15 U.S.C. §7704) for deceptive headers/unsolicited promo; RFC 5322 header integrity; DMARC alignment per RFC 7489 unmet; SPF alignment per RFC 7208. Prior complaints ignored; spam persists. Host: LeaseWeb Netherlands ([email protected]). Also notify NYI for 173.228.155.53 ([email protected]).
show less
Filling out web page forms with spam:
[email protected] via host.oil4car.com
10:33 ...
show moreFilling out web page forms with spam:
[email protected] via host.oil4car.com
10:33 AM (28 minutes ago)
to me
Be careful with this message.
This message isn't authenticated and the sender can't be verified. Use caution when clicking links, downloading attachments, or replying with personal information.
You have received a new message from High Tech Oil's contact form:
Name: Lara Casteel
Email: [email protected]
Message:
Hello from SeoBests,
Supercharge your website’s rankings, increase your search visibility and gain powerful backlinks!
Order the top SEO services all on one platform - SeoBests.com
Don’t miss current SEO deals:
50% SALE - Monthly SEO Services + Receive 5000 Backlinks FREE:
https://tiny.cc/SeoBests-Discount
show less
Received Fri, 15 Aug 2025 15:27:45 -0700 (PDT). Sender IP: 23.137.132.246 (AS26548, PureVoltage Host ...
show moreReceived Fri, 15 Aug 2025 15:27:45 -0700 (PDT). Sender IP: 23.137.132.246 (AS26548, PureVoltage Hosting Inc; [email protected]). Intermediate MTA: 173.228.155.53 (Sailthru; [email protected]).
Phishing: pretends to be “Gmail Support Team”; subject claims “Your Subscription will be Closed [Final Warning]”. Body pushes urgency, fake account details, and buttons like “Secure Your Device” leading to storage.googleapis.com/… to harvest credentials. Multipart/HTML obfuscation with random strings; unsolicited bulk email; recipient never subscribed.
Auth: SPF PASS for tappearanced.net via 23.137.132.246; DKIM PERMERROR (no key for d=0ypyi6…); DMARC not present/unaligned. Likely violations: CAN-SPAM (15 U.S.C. §7701 et seq.—deceptive headers/subject, no valid consent/opt-out), RFC 5322/5321 (misleading headers), RFC 6376 (bad DKIM), RFC 7489 (DMARC missing). Spam continues despite complaints; host appears indifferent.
show less
Received Fri, 15 Aug 2025 13:20:33 -0700 (PDT). Unsolicited mail impersonating a payment notice (“di ...
show moreReceived Fri, 15 Aug 2025 13:20:33 -0700 (PDT). Unsolicited mail impersonating a payment notice (“direct deposit $13,963.99”) with a deceptive display name (“CashApp”), random sender domain, and obfuscated HTML. Links point to external storage/redirects urging “Confirm.” Gmail shows injection from 89.234.149.30 (guttumwali.uk) direct to mx.google.com. Auth: SPF=PASS for esteric.biz subdomain; no DKIM observed; no DMARC result/alignment visible. Behavior matches phishing/spoofing. Deceptive headers/subject violate CAN-SPAM (15 U.S.C. §7704); scheme may constitute wire-fraud (18 U.S.C. §1343). Header practices conflict with RFC 5322; authentication lacks DKIM/DMARC per RFC 6376/7489. Host for 89.234.149.30: Techcréa Solutions SAS (FirstHeberg) — [email protected], +33 806 110 403. Prior complaints to this provider have not stopped the traffic; spam continues from multiple IP's.
show less
Received Aug 15, 2025 at 3:59 PM EDT. Suspicious message with subject “Payment Sent to your Account- ...
show moreReceived Aug 15, 2025 at 3:59 PM EDT. Suspicious message with subject “Payment Sent to your Account-ID: 86246055” came via 89.234.143.135 (HELO rattacking.pro) to Google. The From name misused the recipient’s name; local part is random. Body is a fake payment/verification notice urging “confirm your info,” with obfuscated links (e.g., storage.googleapis.com redirectors) and heavy HTML, typical of credential-harvesting. SPF: PASS for fabrication-gmail.mail-check.info.eclipsecorex.com. DKIM: none observed. DMARC: none observed. Header irregularities: conflicting Received paths, misuse of multipart/report for non-DSN content; deceptive From—contrary to RFC 5322/5321 and multipart/report expectations (RFC 6522). Violations: CAN-SPAM (15 U.S.C. §7701 et seq.); potential wire-fraud (18 U.S.C. §1343).
show less
Received: Aug 15, 2025 12:48:25 PDT. Unsolicited promo “Ulta Beauty Mystery Box” sent via 89.41.182. ...
show moreReceived: Aug 15, 2025 12:48:25 PDT. Unsolicited promo “Ulta Beauty Mystery Box” sent via 89.41.182.193 (HELO: bartell.bdaymhjewerlyshop.com / ptr hinted as libetwitt.liberation.fr), Return-Path [email protected] but visible From is “Ulta” <…nbcn2qevj3.us>—clear brand impersonation and header misalignment. SPF=pass for dpcp.com; DKIM=none; DMARC=not present/aligned (From domain not covered). Multipart HTML is obfuscated/garbled and includes nonsensical dates (“Sep 0, 2019”), typical spam kit. Likely violates CAN-SPAM (15 U.S.C. §7701 et seq.) and RFC 5322 (invalid Sender header “46ssu9gf”, misleading From); also abuses RFC 7208/7489 alignment principles. Headers forwarded to the provider; spam persists—the host appears unresponsive to complaints. Network owner: HZONE SRL (TENNET TELECOM SRL). Abuse: [email protected]. Phone: +40-730-358466.
show less
Received 2025-08-15 13:17:10 UTC. Unsolicited marketing invite “Agentic HR: Beyond 2025” sent to a c ...
show moreReceived 2025-08-15 13:17:10 UTC. Unsolicited marketing invite “Agentic HR: Beyond 2025” sent to a corporate mailbox via Google relay (mail-yw1-x1144.google.com / 2607:f8b0:4864:20::1144) and delivered through Microsoft 365. Authentication: SPF=none for globehireconnect.org; DKIM=pass (d=globehireconnect.org); DMARC=bestguesspass/action=none; compauth=pass; EOP SCL=5. Header chain shows Gmail API ‘HTTPREST’ submission with multiple O365 protection hops, consistent with bulk outreach. This spam persists despite prior complaints—headers are forwarded to the host, but the abuse continues. Potential CAN-SPAM §7704 issues if the body lacks a working opt-out or physical address. No explicit RFC 5321/5322 violations visible from headers; weak auth (no SPF/DMARC policy) undermines trust.
show less
Received on Aug 15, 2025 at 09:03 ET. Unsolicited commercial email pitching “information technology ...
show moreReceived on Aug 15, 2025 at 09:03 ET. Unsolicited commercial email pitching “information technology & services” articles and name-dropping our company. Path shows Gmail delivery via mail-il1-x133.google.com (2607:f8b0:4864:20::133) after SMTP submission from revgen-ionos-sender-01 [216.250.124.116]. Microsoft filtering flagged it as spam (SCL=5). Authentication: SPF=pass, DKIM=pass (clearviaz-co.20230601.gappssmtp.com), DMARC=pass; headers look syntactically compliant (no obvious RFC 5321/5322 defects). Despite authentication, this appears to be unwanted bulk marketing and may violate CAN-SPAM (15 U.S.C. §7704) if the body lacks a valid physical address/opt-out or uses deceptive solicitation.
show less