synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇦 91.232.31.93	14 Aug 2025	Received on Aug 14, 2025 at 11:34:06 −0400. Unsolicited commercial email pushing an ED “assessment,” ... show more Received on Aug 14, 2025 at 11:34:06 −0400. Unsolicited commercial email pushing an ED “assessment,” impersonating a brand and linking to content hosted on Google Storage. Header shows delivery from 91.232.31.93 (“riflethoughtless.mex.com”). Auth results: SPF=pass for a subdomain of danciscarpend.com; DKIM=none; no DMARC result/alignment shown. Message-ID was missing (added by Gmail), and “multipart/report” was used for advertising; randomized subdomains and obfuscated sender indicate misleading/forged headers. Likely violations: CAN-SPAM (unsolicited UCE, deceptive/misleading header/sender identity, absence of verifiable consent) and RFC 5322 (missing/forged Message-ID). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 136.147.233.205	14 Aug 2025	Received Aug 14, 2025 13:01:11 UTC. Unsolicited commercial email advertising “Future-Proof Your SEO ... show more Received Aug 14, 2025 13:01:11 UTC. Unsolicited commercial email advertising “Future-Proof Your SEO Strategy” sent via Salesforce Marketing Cloud MTA anw205.mta.exacttarget.com (136.147.233.205). Bulk traits: tracking job IDs, List-Unsubscribe, Reply-To to a marketing domain. Microsoft filtering marked SCL=5/SPM. Auth results: SPF=pass, DKIM=pass (d=lumenpathstrategies.com), DMARC=pass; no envelope/headers anomalies observed. This appears to be unsolicited bulk marketing; if sent without consent it likely violates CAN-SPAM (15 U.S.C. §7701 et seq.). No obvious RFC 5321/5322 violations; issue is unsolicited bulk. Host: Salesforce.com, Inc. (Marketing Cloud/ExactTarget). Abuse: [email protected], [email protected]; phones +1-317-423-3928 / +1-415-901-7000. All headers reported to the host; complaints ignored and spam continues. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇮🇳 43.204.115.35	14 Aug 2025	Received on Aug 13, 2025 at 11:38 AM EDT (≈15:38:06–10 UTC). Unsolicited marketing message with subj ... show more Received on Aug 13, 2025 at 11:38 AM EDT (≈15:38:06–10 UTC). Unsolicited marketing message with subject “5 lead magnet ideas that actually drive action in 2025,” flagged by Microsoft filtering (SCL=5; CAT=PHISH). Header trace shows authenticated submission from AWS EC2 host 43.204.115.35 to smtp.gmail.com, relayed by mail-pg1-x531.google.com, then delivered into O365. SPF=pass, DKIM=pass (d=ontraportsolutionspro.com), DMARC=pass. Potential CAN-SPAM (15 U.S.C. §7701 et seq.) noncompliance if sent without consent and lacking required disclosures/opt-out; no explicit RFC 5321/5322 header violations observed in this trace. Reporting these headers to the responsible providers. No clear RFC 5321/5322 header-format violations evident in the provided trace. Amazon Web Services, Inc. (origin host of 43.204.115.35 / EC2) — Email: [email protected] or [email protected]. (AWS documents Trust & Safety reporting here.) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 153.92.236.156	14 Aug 2025	Received Aug 13, 2025 13:37:49 UTC. Unsolicited commercial bulk email promoting “Session Spotlight: ... show more Received Aug 13, 2025 13:37:49 UTC. Unsolicited commercial bulk email promoting “Session Spotlight: Case Study by Palo Alto Networks” and the EV Charging Summit. Origin: 153.92.236.156 (mailer.evchargingsummit.com) using Brevo/Sendinblue infrastructure. Microsoft filtering flagged it SCL=6 / CAT: SPM. SPF pass, DKIM pass (d=gsmiweb.com), DMARC pass—so not spoofed, but still abusive marketing. Repeated mailings from this source persist after prior complaints; spam continues and the host appears unresponsive to abuse reports. Potential legal issues: may violate U.S. CAN-SPAM (15 U.S.C. §7701-7713) if sent without consent and without required disclosures. No obvious RFC 5321/5322/7208/6376/7489 violations seen in header. Please investigate and stop further mail from this IP. IP owner / abuse contact (for your complaint email): Sendinblue SAS (Brevo) – [email protected] (AS200484). whois.ipinsight.io IPinfo Company phone (Brevo/Sendinblue): +33 1 75 43 78 64. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇺🇸 209.141.38.12	14 Aug 2025	Received Thu, Aug 14, 2025 06:42 PDT via 209.141.38.12 (rDNS 0C.26.8DD1.ip4.static.sl-reverse.com). ... show more Received Thu, Aug 14, 2025 06:42 PDT via 209.141.38.12 (rDNS 0C.26.8DD1.ip4.static.sl-reverse.com). Message impersonates “Verizon” and claims the recipient “won” a Dell Inspiron, pushing clicks to storage.googleapis.com and a tinyurl redirector. Header chain shows unrelated sailthru.com hops and a later handoff from 209.141.38.12, consistent with header manipulation/spoofing. Auth results: SPF=PASS for [email protected]; DKIM=not present; DMARC=not present. RFC issues: invalid “Sender” header lacking a mailbox (RFC 5322 §3.6.2); Content-Type falsely set to multipart/report (RFC 6522) while carrying HTML; misleading headers (RFC 5322). Violations: CAN-SPAM (15 U.S.C. §7701 et seq.—deceptive subject/headers, no lawful identification/opt-out) and attempted fraud (18 U.S.C. §1343). Host owner & contacts for 209.141.38.12: FranTech Solutions (AS53667 “PONYNET-04”). Abuse email: [email protected]. Phone: +1-778-977-8246. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 23.111.147.197	14 Aug 2025	Received on Aug 14, 2025 08:02:58 -0400. Unsolicited bulk email with deceptive subject claiming acce ... show more Received on Aug 14, 2025 08:02:58 -0400. Unsolicited bulk email with deceptive subject claiming acceptance and $8,000 “bonus”, embedding redirect links to storage.googleapis.com and obfuscated HTML—clear phishing/advance-fee lure. Routed from solarzing.dev [23.111.147.197] via ESMTPS; Return-Path domain survivorfanwiki.com mismatches From domain 344bad.7fda1e.x7ybjs.us. Auth results: SPF=pass for survivorfanwiki.com; DKIM=permerror (no key published) for 344bad.7fda1e.x7ybjs.us; DMARC not present/unaligned. Indicators: forged branding, random strings, multipart/related payload, pressure to click. Violates CAN-SPAM (misleading headers/subject, missing valid address/opt-out) and may constitute wire fraud; contravenes RFC 5322 (header integrity) and RFC 6376/7489 (DKIM/DMARC). Mail-server host for 23.111.147.197: Hivelocity, Inc. (AS29802). Abuse: [email protected]; Phone: +1-888-869-4678 show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 89.163.214.250	14 Aug 2025	Received Thu, 14 Aug 2025 00:43:20 -0700 (PDT). Bulk/phishing mail impersonating “UnitedHealthCare” ... show more Received Thu, 14 Aug 2025 00:43:20 -0700 (PDT). Bulk/phishing mail impersonating “UnitedHealthCare” with a deceptive subject using the recipient’s name and a “verify now” lure; links resolve to storage.googleapis.com; HTML is obfuscated. Delivered via 89.163.214.250 (libetwitt.liberation.fr / quigley.basketalike.com). Auth results: SPF pass for 033755.com; DKIM none; DMARC none observed; ARC cv=none. Header anomalies include multipart/report used for marketing, bogus sender token, and broken Message-ID. Violations: CAN-SPAM (15 U.S.C. §7701 et seq.—deceptive headers/subject, no valid opt-out); RFC 5321/5322 (misleading identifiers); RFC 6376/7489 (unauthenticated domain use). Host: WIIT AG (formerly myLoc managed IT AG). Abuse: [email protected]; phone +49 211 61708110. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 178.162.185.71	14 Aug 2025	Received Wed, 13 Aug 2025 19:31:21 -0700 (PDT). Deceptive marketing blast about “energy savings/sola ... show more Received Wed, 13 Aug 2025 19:31:21 -0700 (PDT). Deceptive marketing blast about “energy savings/solar financing” with mismatched headers and links to third-party storage. Subject promises “up to 70% energy savings” and urges an immediate “learn more” click. Sending IP connecting to Gmail: 178.162.185.71 (HELO barton.advanoalthcare.com / libetwitt.liberation.fr). Message chain also shows njmta-53.sailthru.com 173.228.155.53. Auth: SPF=pass for [email protected]; DKIM=none seen; DMARC=not present. Return-Path and From domains do not match; ARC cv=none; Message-ID marked SMTPIN_ADDED_BROKEN. Violates CAN-SPAM (15 U.S.C. §7701 et seq.) and RFC 5322 (invalid Sender), RFC 3462/6522 (misuse of multipart/report), plus malformed Date zone. Hosting provider for 178.162.185.71: Leaseweb ([email protected]). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 178.162.194.177	14 Aug 2025	Received Wed, 13 Aug 2025 15:35:56 -0700 (PDT). Phishing email impersonates “Gmail Support Team” war ... show more Received Wed, 13 Aug 2025 15:35:56 -0700 (PDT). Phishing email impersonates “Gmail Support Team” warning “Your Subscription will be Closed [Final Warning]”. Body is gibberish plus HTML with a redirect link, pressuring urgent action. Unsolicited and deceptive; prior complaints have not stopped this sender—the spam persists. Auth: SPF pass for smtp.mailfrom domain on 178.162.194.177; DKIM permerror (d=ga09le.razdwv.4grpsu.us, no valid key); DMARC fail by misalignment (SPF/DKIM domains don’t match the From domain). Noncompliant with RFC 6376 (invalid DKIM) and fails DMARC alignment (RFC 7489); deceptive header/subject violate CAN-SPAM (15 U.S.C. §7704) and indicate attempted wire fraud (18 U.S.C. §1343). Sending IP: 178.162.194.177 (Leaseweb, AS28753; host greeting “cafly.lightenedos.com.se”). Earlier hop seen: 173.228.155.53 (njmta-53.sailthru.com). Please investigate and suspend the origin. Abuse contact: [email protected]. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇲🇩 176.123.5.23	14 Aug 2025	Received Wed, Aug 13, 2025 17:26:22 -0400. Unsolicited adult “enhancement” marketing with obfuscated ... show more Received Wed, Aug 13, 2025 17:26:22 -0400. Unsolicited adult “enhancement” marketing with obfuscated links and random padding text. Subject “More Power, More Pleasure – Guaranteed!”; urges purchases via redirect URLs. Evidence: Delivered via sawage.shorells.net [176.123.5.23] to mx.google.com; earlier hop shows njmta-53.sailthru.com [173.228.155.53], rDNS: 176-123-5-23.hinet-ip.hinet.net (misleading). MAIL FROM/Return-Path: [email protected]; From: “Go Longer, Stay Stronger” <…@…> (mismatch). SPF: PASS; DKIM: none; DMARC: none/absent. Host for 176.123.5.23: ALEXHOST SRL; abuse: [email protected]. Violations: CAN-SPAM (unsolicited, misleading subject/headers, no valid business details). RFC: misuse of Content-Type multipart/report for non-DSN (RFC 3462); header/domain misalignment per RFC 5321/5322. Owner & abuse contact for 176.123.5.23: ALEXHOST SRL — [email protected] (per RIPE/IP info and provider pages). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 51.15.4.166	14 Aug 2025	Received 2025-08-13 14:09:22 PDT. Unsolicited gambling promo (“400% UP TO €2000”) from display name ... show more Received 2025-08-13 14:09:22 PDT. Unsolicited gambling promo (“400% UP TO €2000”) from display name “Rewards_Team” using a random subdomain sender. Multipart message with base64 junk; urges clicking a redirect link to “claim winnings.” This is bulk, deceptive marketing; headers are attached for review. Auth results: SPF PASS for tepid-radiograph.nebulisation.blunk.persector.net via 51.15.4.166; DKIM PERMERROR (no DNS key) for 70kvgg.im2n6x.lv3gpe.us; DMARC result not present/unaligned with From. Received chain includes unrelated Sailthru hosts, suggesting spoofing/forgery. Connecting IP: 51.15.4.166 (Scaleway / Online SAS NL, [email protected]). Other mail host seen: 173.228.155.53 (NYI / Sailthru, [email protected]). Likely violates CAN-SPAM (unsolicited, misleading headers/subject) and RFCs 5322, 6376, 7489. Full headers are reported to the host. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 163.172.221.172	14 Aug 2025	Phishing/spam received Aug 13, 2025 at 1:58:42 PM PDT. Message impersonates “Gmail Support Team” wit ... show more Phishing/spam received Aug 13, 2025 at 1:58:42 PM PDT. Message impersonates “Gmail Support Team” with subject “Your Subscription will be Closed [Final Warning],” urging urgent clicks to a storage link; body padded with random text to evade filters. This campaign persists despite prior complaints; the host appears unresponsive as spam continues. Auth results: SPF=pass for [email protected]; DKIM=none; DMARC=none/absent. Headers show misleading branding and a Gmail-added Message-ID (SMTPIN_ADDED_MISSING), inconsistent Received/rDNS, and misuse of multipart/report—behavior contrary to RFC 5322 and RFC 7489 alignment. Likely violations: CAN-SPAM (15 U.S.C. §7701 et seq.) and U.S. wire-fraud statute (18 U.S.C. §1343). Sending IP: 163.172.221.172. Relay/MTA observed: 173.228.155.53 (njmta-53.sailthru.com). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇲🇩 176.123.5.52	14 Aug 2025	Received Aug 13, 2025 13:55 PDT. Phishing spam posing as “Cloud Support” about an expired cloud subs ... show more Received Aug 13, 2025 13:55 PDT. Phishing spam posing as “Cloud Support” about an expired cloud subscription, pushing renewal via links. Body shows random strings and obfuscated HTML; misleading subject uses the recipient’s name. Multipart/report used for non-bounce content. Headers show handoff from 176.123.5.52 (shorells.net) with earlier hop via 173.228.155.53 (njmta-53.sailthru.com). SPF: PASS for overlay-update.uber-mail.service.leiving.com via 176.123.5.52. DKIM: none. DMARC: none. Evidence of forged/misleading headers. Network owners: 176.123.5.52 — ALEXHOST SRL ([email protected]); 173.228.155.53 — NYI ([email protected]). Violates CAN-SPAM (15 U.S.C. §7701) due to deceptive subject/consent failure; potential 18 U.S.C. §1343 wire-fraud; likely RFC 5321/5322 header issues. Prior complaints ignored; spam continues—please investigate and suspend the source. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 212.83.155.86	13 Aug 2025	Received Wed, 13 Aug 2025 15:17:02 -0400. Malicious bulk message claiming a “direct deposit of $50,0 ... show more Received Wed, 13 Aug 2025 15:17:02 -0400. Malicious bulk message claiming a “direct deposit of $50,000.00” and urging the recipient to confirm/payment via embedded links; body is obfuscated HTML/text to evade filters. From field used the recipient’s name as false. Apparent envelope-from domain ‘development-access.datahub.commerce.gov.catarious.net’ with SPF pass on 212.83.155.86, but it is non-aligned with visible From; DKIM: none; DMARC: none/absent → likely fails alignment. Headers show connection from 212.83.155.86; domain construction imitates a government domain to mislead. This spam has continued despite prior reports—host appears indifferent. Provider believed to be Scaleway/Online SAS. Abuse: [email protected]; phone: +33 1 84 13 00 00; portal: abuse.online.net. Laws: CAN-SPAM (15 U.S.C. §7701 et seq.), attempted wire fraud (18 U.S.C. §1343). RFCs: 5321/5322 (misleading originator), 7489 (DMARC misalignment). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 192.210.198.18	13 Aug 2025	Received on Aug 13, 2025 at 10:48:36 PDT. German-language casino lure: subject “Du hast gerade 4.000 ... show more Received on Aug 13, 2025 at 10:48:36 PDT. German-language casino lure: subject “Du hast gerade 4.000 € gewonnen – Jetzt bestätigen” with links via Google Cloud Storage redirect to a “Turbo Wins” gambling site. Headers show send from 192.210.198.18 (echoridgenovacraft.org.uk / spectrum.com rDNS) with return-path at manadareene-grreanze.com.urbanflare.info; misaligned domains and a misleading X-header claiming “Trusted Sender” delegation indicate spoofing/impersonation. Auth: SPF=pass; DKIM=none; DMARC=no result/alignment not shown; ARC cv=none. Violations: CAN-SPAM (deceptive subject, misleading headers, no clear physical address/legit opt-out); probable RFC 5322 non-conformant formatting (duplicated/malformed HTML, excessive padding). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 91.109.23.177	13 Aug 2025	Received Aug 13, 2025 13:30:18 -0400. Unsolicited gambling/payout lure (“Your $7,546.94 is ready”) s ... show more Received Aug 13, 2025 13:30:18 -0400. Unsolicited gambling/payout lure (“Your $7,546.94 is ready”) sent via 91.109.23.177. Bulk marketing, obfuscated HTML, storage.googleapis.com redirect, random tokens, false urgency; seeks click-through. Auth: SPF PASS (smtp.mailfrom fractal-episiotomy…newstampedera.com); DKIM PERMERROR (no key for d=hdo50z.iigcuf.0zarfn.us); DMARC not shown. Non-compliant use of multipart/report meant for DSNs (RFC 3464/6522). Gmail added missing Message-ID (SMTPIN_ADDED_MISSING), contrary to RFC 5322 best practice. Violates CAN-SPAM (15 U.S.C. §§7701-7713): deceptive subject, no valid business address, consent not obtained. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 23.95.24.212	13 Aug 2025	Received Aug 13, 2025 10:28:15 PDT. Unsolicited bulk commercial email pitching “whole life insurance ... show more Received Aug 13, 2025 10:28:15 PDT. Unsolicited bulk commercial email pitching “whole life insurance” quotes. Deceptive/obfuscated headers: final hop doyle.throportant.net [23.95.24.212]; Return-Path uses low-bastion.crimson.tress.stylerbergrecords.com while the visible From is a random local-part at an unrelated throwaway subdomain; multipart/report used to mask marketing content with long tracking HTML. Auth results: SPF pass for stylerbergrecords.com on 23.95.24.212; DKIM absent; DMARC not present/alignment not met; ARC cv=none. Gmail added a missing Message-ID (SMTPIN_ADDED_MISSING). Spam continues despite prior complaints to the host. Likely violates CAN-SPAM (15 U.S.C. § 7704; deceptive/misleading header/subject). RFC concerns: RFC 5322 (header integrity) and RFC 7489 (DMARC alignment). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 51.15.4.166	13 Aug 2025	Received Aug 13, 2025 12:36:13 -0400. Bulk phishing email impersonating “Cloud Storage Team” with ur ... show more Received Aug 13, 2025 12:36:13 -0400. Bulk phishing email impersonating “Cloud Storage Team” with urgent “Protect Your Files” subject, pushing an “upgrade cloud storage” action; content includes obfuscated links and filler text. Sent from 51.15.4.166 (outbreactisin.com) with Return-Path at clothes.width.funbet1.inc-org.solarechocorex.com while From uses unrelated lq9sk1.s66hcj.v64xal.us—classic multi-domain spoofing. Auth results: SPF=pass for the funbet1… domain; DKIM=permerror (no key) for lq9sk1… (RFC 6376); DMARC: none/alignment absent (RFC 7489). Gmail added a missing Message-ID; body misuses multipart/report for a marketing payload. Likely credential-harvest/brand impersonation. Violates CAN-SPAM (15 U.S.C. §7701 et seq.) via deceptive subject/misleading header alignment; may implicate 18 U.S.C. §1343 (wire fraud) if credentials are solicited. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 5.39.31.122	13 Aug 2025	Received Aug 13, 2025 12:32:22 -0400. Malicious bulk mail sent from 5.39.31.122 via workouttips.net, ... show more Received Aug 13, 2025 12:32:22 -0400. Malicious bulk mail sent from 5.39.31.122 via workouttips.net, posing as an urgent “payment declined / account at risk—photos & videos will be deleted” notice. Uses a nonsense From display name and random subdomain sender; body hides a cloud-storage link and filler to evade filters. SPF: pass for quantumtidex.info but not aligned to visible From; DKIM: none; DMARC: none/unaligned; ARC: cv=none. Header shows “Message-ID … [email protected]”, indicating the original lacked a Message-ID (RFC 5322), and it misuses multipart/report DSN structure (RFC 3462/6522). Violates CAN-SPAM (15 U.S.C. §7704: deceptive subject/headers, no proper opt-out) and may constitute wire fraud. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇿 31.13.224.146	13 Aug 2025	Received Aug 13, 2025 at 12:11:48 EDT. This is a casino/“$50,000 direct deposit” lure with brand imp ... show more Received Aug 13, 2025 at 12:11:48 EDT. This is a casino/“$50,000 direct deposit” lure with brand impersonation (“CashApp”) and an urgent 48-hour deadline. Links go to a storage.googleapis.com redirect chain leading offsite. Header anomalies: From shows “CashApp” with an invalid/non-FQDN domain info@xikopwcvhu; envelope domain committee.discount.funbet1.inc-org.macheduled.com; sending host walkcow.uk.com [31.13.224.146]. Auth results: SPF=pass (for committee.discount…); DKIM=neutral (bad version); DMARC=none/absent. Likely CAN-SPAM violations (deceptive subject/claims) and attempted wire fraud (18 U.S.C. §1343). RFC non-compliance: DKIM bad version (RFC 6376); From domain not FQDN per RFC 5321/5322 guidance. Abuse persists; host appears unresponsive to complaints. Network owner: HOSTPERL (AS151612). Report to [email protected], phone +64 22 356 3277. Sources for host/abuse contact & IP mapping: IPinfo WHOIS for 31.13.224.0/24 ([email protected], HOSTPERL/AS151612) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 163.172.81.246	13 Aug 2025	Received Aug 13, 2025 11:38 AM EDT. Bulk deceptive mail promising "$7,546.94 is ready" and pressurin ... show more Received Aug 13, 2025 11:38 AM EDT. Bulk deceptive mail promising "$7,546.94 is ready" and pressuring confirmation before 11:59 PM, linking to external storage; body uses generic payout/"account console" lures typical of phishing. Authentication: SPF=pass for clothes.width.funbet1.inc-org.southeatres.org; DKIM=permerror (no key published for 63d9tw.egz5xr.doju34.us); DMARC=not present/unaligned. From field used the recipient’s name falsely. Likely violations: CAN-SPAM (15 U.S.C. §7704: misleading subject/headers, deceptive claims, inadequate unsubscribe) and 18 U.S.C. §1343 (wire fraud). RFC issues: 5322 (misleading From/Subject), 6376 (DKIM permerror), 7489 (absent DMARC). Source IP 163.172.81.246 appears hosted by Scaleway/Online SAS Company: Scaleway / Online SAS Abuse email: [email protected] (also accepts via their abuse portal at abuse.online.net) Phone: +33 1 73 50 20 00 (RIPE WHOIS contact for AS12876) Additional abuse contact often listed: [email protected] (group abuse contact) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 23.95.24.211	13 Aug 2025	Spam/phishing received Aug 13, 2025 10:36 AM EDT. Subject claims “direct deposit $13,963.99,” impers ... show more Spam/phishing received Aug 13, 2025 10:36 AM EDT. Subject claims “direct deposit $13,963.99,” impersonating Cash App; links point to Googleapis storage and other obfuscated domains. Mail accepted from leannon.throportant.net [23.95.24.211]. Auth results: SPF=pass for explainstanda.net; DKIM=none; DMARC=none shown/unaligned. Message misuses a misleading display name and “multipart/report” to mimic a delivery-status notice; body is filler with an unsubscribe lure. Likely credential/advance-fee bait. Violates CAN-SPAM (15 USC §7704: deceptive subject/headers, non-functional opt-out) and may implicate 18 USC §1343 (wire fraud); header practices conflict with RFC 5322 and DMARC alignment (RFC 7489). HostPapa (AS36352 / ColoCrossing) — abuse: [email protected], phone +1-905-315-3455. Additional abuse contacts seen for this prefix: [email protected], [email protected] (ColoCrossing), phone +1-800-518-9716. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 159.112.249.46	13 Aug 2025	Received on 2025-08-13 at 09:35:44 EDT. Unsolicited commercial email advertising cosmetic procedures ... show more Received on 2025-08-13 at 09:35:44 EDT. Unsolicited commercial email advertising cosmetic procedures. Message was sent via Mailgun infrastructure (m249-46.rdns-1.mailgun.net / 159.112.249.46) using a bounce+tag address; content includes promo language, call-to-book, tracking links, and one-click unsubscribe. Authentication: SPF pass for mail.aestheticconnect.me; DKIM pass for mail.aestheticconnect.me and mailgun.org; DMARC FAIL for gmail.com because the visible From uses gmail.com while the authenticated domains do not align (spoofed From). This appears to violate CAN-SPAM (15 U.S.C. §7704) prohibiting misleading header information. Contravenes DMARC alignment (RFC 7489). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇸🇬 45.125.194.94	13 Aug 2025	Received Aug 13, 2025 at 07:23 EDT. Phishing/spam impersonating “Gmail Support Team” claims a subscr ... show more Received Aug 13, 2025 at 07:23 EDT. Phishing/spam impersonating “Gmail Support Team” claims a subscription will be closed and pushes a redirect link; body includes obfuscated filler and tracking IDs. Auth results: SPF=pass for envelope outsiderinting.com; DKIM=permerror (no key) for From-domain txms51.1bs2o0.7d6qa4.us; DMARC=fail/alignment broken (From-domain not aligned with SPF pass). Message-ID was inserted by Gmail (SMTPIN_ADDED_MISSING), suggesting forged headers. Originating host to Gmail: 45.125.194.94 (schaefer.soondcarabwa.club). Violates CAN-SPAM (15 U.S.C. §7701 et seq.) and likely wire-fraud (18 U.S.C. §1343); conflicts with RFC 5322 (header integrity), RFC 6376 (DKIM), RFC 7489 (DMARC). All headers reported to the mail server’s host. Prior complaints to the host have had no effect; spam continues. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 149.72.116.219	13 Aug 2025	Unsolicited adult marketing email delivered Aug 13, 2025 at 07:09 EDT (11:09 UTC). Message promotes ... show more Unsolicited adult marketing email delivered Aug 13, 2025 at 07:09 EDT (11:09 UTC). Message promotes explicit products via tracking links and is marked bulk (Precedence: bulk). Auth results: SPF pass for mailer host at 149.72.116.219; DKIM pass (g.shopifyemail.com and sendgrid.info); DMARC pass (aligned with shopifyemail.com). Auth per RFC 7208/6376/7489 passed; no RFC 5321/5322 header violations observed. This is unsolicited bulk advertising and likely violates CAN-SPAM (15 U.S.C. §7704) if sent without prior consent and compliant identification/opt-out. Please investigate and terminate the sender’s ability to send. Prior complaints have not stopped this stream; the host appears to ignore abuse as the spam continues. Abuse reporting email: [email protected] (official) Twilio SendGrid does not publish a dedicated public abuse phone; they direct abuse reports to the email above (phone support is for paying customers) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing