synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇸🇬 45.125.194.94	13 Aug 2025	Received Wed, Aug 13, 2025 07:01 EDT. Malicious mail claims a “direct deposit” of €/£8000 and pushes ... show more Received Wed, Aug 13, 2025 07:01 EDT. Malicious mail claims a “direct deposit” of €/£8000 and pushes verification links (incl. storage.googleapis.com redirects) to harvest data. From field used the recipient’s name falsely. Auth results: SPF PASS for avenida-uskf-austarliaann.sifdavgplican.com via 45.125.194.94; DKIM PERMERROR for d=2c7phg.ckzd39.6q8rjo.us; DMARC alignment absent/failed (From domain not aligned). Routing: schaefer.soondcarabwa.club [45.125.194.94]. This appears to violate CAN-SPAM (deceptive headers/subject, no valid opt-out/physical address) and constitutes phishing/wire-fraud intent; non-compliant with RFC 5322 and RFC 7489/7208 alignment. Host / abuse contact for 45.125.194.94 (owner of 45.125.194.0/24): Company: Ready Server Pte Ltd (AS63930). IPinfo Abuse email: [email protected]. APNIC Phone: +65-6636-8873 Phishing implies potential wire-fraud exposure (18 U.S.C. §1343). Header/auth issues are inconsistent with RFC 5322 (misleading “From”) show less	Fraud Orders Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.3.139.186	13 Aug 2025	Received on 2025-08-13 05:48:01 -0400. Casino/“free spins” blast with subject “400% Bonus up to €200 ... show more Received on 2025-08-13 05:48:01 -0400. Casino/“free spins” blast with subject “400% Bonus up to €2000 + 145 Free Spins,” numerous tracker/redirect links (incl. storage.googleapis.com), and credential-bait copy (“activate account,” “password stored”). Delivered via sourers.com [50.3.139.186]. Auth: SPF PASS for obacicbalance.biz (envelope), DKIM PERMERROR (no key) for xp1tmw.8fg6rz.fqoqyc.us; DMARC result not shown and domains misaligned. Header misuse: Content-Type: multipart/report (RFC 6522/3462 DSN type) used for marketing; original Message-ID missing (added by Gmail) — RFC 5322 non-compliance. Ongoing complaints ignored; spam continues from this host. Likely CAN-SPAM violations (misleading content/opt-out). Network owner: Eonix Corporation (AS62904). Abuse desk: [email protected], [email protected], +1-702-605-2981. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 89.144.58.185	13 Aug 2025	Received Aug 13, 2025 at 05:15:07 EDT. Message is unsolicited casino marketing using deceptive forma ... show more Received Aug 13, 2025 at 05:15:07 EDT. Message is unsolicited casino marketing using deceptive formatting; subject “89.144.58.185 Check your mail - your money 💰💲 is waiting!”. Sending MTA: walsh.advantagon.co.uk. Sending IP / MTA IP: 89.144.58.185. Auth results: SPF=pass for envelope sender domain walsh.advantagon.co.uk; DKIM=permerror (no DNS key) for aff49u.lzqgeq.dbnm29.us; DMARC=not present. Misuse of multipart/report (report-type=delivery-status) to carry marketing content. Violates RFC 6376 (DKIM), contradicts RFC 7489 practices; abuses RFC 3462. Activity likely violates anti-spam statutes (e.g., CAN-SPAM, 15 U.S.C. §7701 et seq.) due to unsolicited marketing and deceptive headers. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇦 194.54.187.141	13 Aug 2025	Received Aug 12, 2025 at 8:29 PM EDT. Bulk “prize” spam posing as a well-known retailer and claiming ... show more Received Aug 12, 2025 at 8:29 PM EDT. Bulk “prize” spam posing as a well-known retailer and claiming a “YETI War Survival Kit” reward. Sending IP: 194.54.187.141 from jones.parapraxi.com. Host appears to be Ellipse Ltd (AS21500/Technaukservice). Abuse: [email protected]. Additional trace seen: 162.247.118.132. Auth results: SPF=pass for [email protected]; DKIM=pass for y6i69urhy6rbskc.amino.sis.foutmad.co; no DMARC result shown. Headers show deception/forgery (bogus X-Google-* and delegation lines), invalid Content-Transfer-Encoding token “amazonses” (RFC 2045), misuse of multipart/digest with HTML body (RFC 2046), questionable Message-ID domain (RFC 5322). This violates the U.S. CAN-SPAM Act (15 U.S.C. §7704: deceptive subject/headers, unsolicited bulk, improper unsubscribe). The spam continues despite prior reports; the host appears to care nothing about spam complaints. Please investigate and terminate abuse at the above IPs and infrastructure. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.102.118.209	13 Aug 2025	Received Tue, Aug 12, 2025 at 6:37 PM EDT. Phishing email impersonating “Gmail Support Team” claims ... show more Received Tue, Aug 12, 2025 at 6:37 PM EDT. Phishing email impersonating “Gmail Support Team” claims “Subscription Termination/Final Warning” and urges renewal via buttons linking to storage.googleapis.com. Body includes scare language about device security and account closure. Reply-To set to a third-party domain, indicating attempted redirection. SMTP client: dubuque.uliticism.nl [27.102.118.209] (DAOU TECHNOLOGY). SPF: pass for [email protected]; DKIM: permerror (no DNS key for icoqjdivntqgaqotbhawzkwy.com); DMARC: not present/not aligned. All headers reported to the hosting company of the mail server. Violations: CAN-SPAM Act (15 U.S.C. §7704 – deceptive subject/headers, misleading opt-out), potential wire fraud (18 U.S.C. §1343) due to credential/financial lures; RFC 5321/5322 header hygiene; RFC 6376 DKIM failed; RFC 7489 DMARC absent. Owner of 27.102.118.209: DAOU TECHNOLOGY (AS45996) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.2.188.221	13 Aug 2025	Received Aug 12, 2025 at 18:17:50 -0400 (EDT). Originated from largesour.com [50.2.188.221] and trav ... show more Received Aug 12, 2025 at 18:17:50 -0400 (EDT). Originated from largesour.com [50.2.188.221] and traversed njmta-53.sailthru.com [173.228.155.53]. The “From” field falsely used the recipient’s name and a randomized sender address; subject is an urgent “Please check your account” lure. Content: templated account/confirmation notice with obfuscated links and base64-like blobs pointing to 3rd-party storage; aims to harvest credentials and push bogus “payment verification.” Auth: SPF=pass for agreements-datahub.overview.commerce.gov.foundark.info via 50.2.188.221; DKIM/DMARC not present; ARC added by Google. Violations: CAN-SPAM (15 U.S.C. §7704—deceptive headers/claims), likely wire fraud attempt (18 U.S.C. §1343); RFC 5322 (original Message-ID missing—Gmail added SMTPIN_ADDED_MISSING), header spoofing. Hosting: 50.2.188.221 is ServerHub/Eonix; abuse: [email protected]. 173.228.155.53 is NYI (Sailthru); abuse: [email protected]. Prior reports ignored; spam persists. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.2.188.220	12 Aug 2025	Received Aug 12, 2025 at 16:21 EDT. Source IP 50.2.188.220 (morissette.discussel.net) connected to G ... show more Received Aug 12, 2025 at 16:21 EDT. Source IP 50.2.188.220 (morissette.discussel.net) connected to Google and injected a bulk solicitation “You’ve Been Considered for inclusion with Who’s Who…”, with long HTML, tracking links, and unsubscribe boilerplate. Authentication: SPF PASS for a deceptive subdomain “agreements-datahub.overview.commerce.gov.hoole.info”; no DKIM shown; no DMARC pass shown/alignment likely absent. Formatting issues: Gmail added a missing Message-ID (suggests RFC 5322 non-compliance); misuse of multipart/report for marketing content. Behavior indicates spoofing/brand-impersonation of a U.S. government domain via look-alike subdomain. This is unsolicited commercial email and appears to violate CAN-SPAM (15 U.S.C. §7701 et seq.). Reported repeatedly to the host; spam continues, indicating no effective mitigation. Host owner / abuse desk (for your records): Eonix Corporation — [email protected], +1-702-605-2981. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.60	12 Aug 2025	Abuse report for IP 104.206.82.60. Received: Tue, 12 Aug 2025 11:18:50 -0700 (PDT). Summary: Brand ... show more Abuse report for IP 104.206.82.60. Received: Tue, 12 Aug 2025 11:18:50 -0700 (PDT). Summary: Brand-impersonation email using the display-name “iCloud Storage” and subject “Confirmation,” linking to a storage.googleapis.com landing page; body stuffed with random text to evade filters. Likely credential-harvest/phishing lure. Headers show odd Sailthru hops inconsistent with the visible sender. Auth: SPF pass for [email protected]; DKIM: none found; DMARC: none found; Gmail added Message-ID (SMTPIN_ADDED_MISSING), indicative of malformed headers. RFC/law: Deceptive headers/From (RFC 5322); absence of DKIM/DMARC (RFC 6376/7489) and misleading content violate CAN-SPAM (15 USC §7704); phishing suggests 18 USC §1343 (wire fraud). Host: Eonix Corporation (AS62904). Abuse: [email protected], +1-702-605-2981. Despite prior complaints, spam continues; host appears unresponsive. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.161.73.162	12 Aug 2025	Received Aug 12, 2025 at 2:10 PM EDT. Message impersonates “Gmail Support,” claiming a subscription ... show more Received Aug 12, 2025 at 2:10 PM EDT. Message impersonates “Gmail Support,” claiming a subscription will be closed with “Final Warning,” and urges clicks to off-domain storage links. From display name abuses brand; subject embeds recipient’s name to coerce action. Auth results: SPF=pass for envelope domain (reproducted.net) but misaligned with From (s3mrmg.us); DKIM=permerror (no key); DMARC: no result shown; alignment appears to fail. Originating MTA: wuckert.prevealedo.com [51.161.73.162] (OVHcloud). Abuse: [email protected], +1-855-684-5463. Likely violations: CAN-SPAM (deceptive headers/subject), potential 18 U.S.C. §1343 if credential theft; RFC 5322 (misleading header fields), RFC 7489 (DMARC misalignment), RFC 6376 (invalid DKIM). Prior complaints have not stopped these messages; spam continues. Host/abuse contacts for 51.161.73.162: OVHcloud (AS16276). Abuse email: [email protected]. Phone: +1-855-684-5463. show less	Fraud Orders Web Spam Email Spam Spoofing Exploited Host
🇺🇸 136.147.233.205	12 Aug 2025	Received 12 Aug 2025 14:14:11 UTC (10:14:11 EDT). Unsolicited commercial email with subject “Future- ... show more Received 12 Aug 2025 14:14:11 UTC (10:14:11 EDT). Unsolicited commercial email with subject “Future-Proof Your SEO Strategy” sent via anw205.mta.exacttarget.com [136.147.233.205] on behalf of lumenpathstrategies.com, promoting SEO services and containing tracking/unsubscribe links. Microsoft filtering marked it spam (SCL=5/SFV:SPM). Auth results: SPF=pass (mailfrom bounce.lumenpathstrategies.com, IP 136.147.233.205), DKIM=pass (d=lumenpathstrategies.com), DMARC=pass (from=lumenpathstrategies.com). No obvious RFC 5321/5322 header violations observed. If sent without consent and lacking required disclosures, this may be non-compliant with CAN-SPAM (15 U.S.C. §7701 et seq.). Ongoing unwanted mail persists despite prior complaints; provider action appears insufficient. These headers are reported to the hosting company. Host / network owner of 136.147.233.205: Salesforce.com, Inc. (Salesforce Abuse NOC). Abuse email: [email protected]. Phone: +1-703-463-3219 show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇰🇷 27.102.115.235	12 Aug 2025	Unsolicited bulk email with subject “Check Your Account” received Aug 12, 2025 at 1:04 PM Eastern. M ... show more Unsolicited bulk email with subject “Check Your Account” received Aug 12, 2025 at 1:04 PM Eastern. Message used the recipient’s name in the From field falsely, forged Reply-To, and contained obfuscated links/lorem filler to evade filters. Origin: 27.102.115.235 (lesch.accordered.net). SPF: pass for a throwaway domain, but header From is misaligned; DKIM: none observed; DMARC: alignment fails. Header chain shows delivery via DAOU TECHNOLOGY/AS45996. This appears to be phishing/social-engineering spam using deceptive headers and content. Violations: CAN-SPAM (15 U.S.C. §7704 – deceptive/misleading headers & unsolicited marketing), possible wire-fraud attempt (18 U.S.C. §1343). RFC issues: 5322 (misleading From), 7208/7489 (SPF/DMARC misalignment). Host has been repeatedly notified; spam continues, indicating poor abuse handling. Abuse contact: [email protected], +82-70-8707-1793 show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 51.158.151.171	12 Aug 2025	Received on Aug 12, 2025 at 12:31:57 -0400. Unsolicited gambling spam with the subject “500% Welcome ... show more Received on Aug 12, 2025 at 12:31:57 -0400. Unsolicited gambling spam with the subject “500% Welcome Bonus PENDING IN YOUR ACCOUNT,” using a random local-part and mismatched domains (display name does not match Return-Path or sending host). Headers show connection from 51.158.151.171 with PTR “51-158-151-171.hinet-ip.hinet.net,” inconsistent with the net owner and suggestive of misrepresentation. Message declares Content-Type multipart/report; report-type=delivery-status but carries marketing HTML—misuse of DSN format (RFC 6522/3464); Gmail added a missing Message-ID. Auth results: SPF=pass for papacifican.net; no DKIM or DMARC observed; ARC cv=none. Links are obfuscated and body contains gibberish filler typical of bulk spam. Likely violates CAN-SPAM (15 U.S.C. §7704) for deceptive headers/subject; if credential or fund harvesting is intended, may implicate wire fraud (18 U.S.C. §1343). Spam persists from this network despite prior complaints; please investigate and suspend the sender. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 23.231.77.69	12 Aug 2025	Received Aug 12, 2025 at 11:27:49 -0400. Suspicious casino payout lure: subject claims a $13,963.99 ... show more Received Aug 12, 2025 at 11:27:49 -0400. Suspicious casino payout lure: subject claims a $13,963.99 “direct deposit” and urges urgent confirmation; links go through a Google Cloud Storage redirect to “Wild Robin Casino.” Display name in From impersonates the recipient. Authentication: SPF=pass for the MAIL FROM domain; DKIM=neutral (“bad version”) for that domain; no DMARC result shown/aligned. Delivered from ymyn.shcache.com [23.231.77.69]. This is deceptive commercial email intended to harvest clicks/credentials. These headers are reported to the hosting company of the mail server. Prior complaints to this host appear ignored; spam continues. Likely violations: CAN-SPAM (15 U.S.C. §7704) for misleading headers/subject and lack of compliant disclosures; RFC 5322/5321 formatting norms; DKIM (RFC 6376) failure; SPF/DMARC policy misalignment (RFC 7208/7489). 23.231.77.69 → Eonix Corporation (AS62904). Abuse: [email protected] Phone: +1-702-605-2981. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 95.168.160.79	12 Aug 2025	Received: 2025-08-12 10:45:55 -0400. Source IP 95.168.160.79 via host “jamesonally.com.de”. Bulk phi ... show more Received: 2025-08-12 10:45:55 -0400. Source IP 95.168.160.79 via host “jamesonally.com.de”. Bulk phishing using a fake “Payment Declined / photos will be deleted” pretext and obfuscated links (incl. storage hosting) to harvest credentials. Auth: SPF pass for return@…auth.email-secure.us.syncophobial.com; DKIM permerror (no key) for From-domain; DMARC not present/unaligned. Header anomalies: misleading display name, mismatched Reply-To, forged/irregular Received chain, localhost Message-ID — RFC 5321/5322; DMARC RFC 7489 not met. Laws: CAN-SPAM (15 U.S.C. §7704) and wire fraud (18 U.S.C. §1343). Reporting to host; prior complaints filed and spam persists. Host: Leaseweb Netherlands B.V.; +31 20 316 2880; [email protected]. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 160.202.162.73	12 Aug 2025	Received Aug 12, 2025 at 09:30 EDT. Unsolicited email with subject ‘Check your account – your £10,00 ... show more Received Aug 12, 2025 at 09:30 EDT. Unsolicited email with subject ‘Check your account – your £10,000 is ready to be claimed,’ pushing a “claim bonus” link and padded with obfuscated text to evade filters. Sent via muller.melviral.com.se [160.202.162.73]; envelope domain successenges.com and header From at jwxp4l.k1t501.66ev9p.us do not match. Auth results: SPF PASS for successenges.com; DKIM PERMERROR (no key) for d=jwxp4l.k1t501.66ev9p.us; DMARC: no result shown/not aligned. This is bulk spam and likely phishing with deceptive headers. Violations: CAN-SPAM (15 U.S.C. §7701 et seq.), potential wire fraud (18 U.S.C. §1343), RFC 5321/5322 (misleading headers), RFC 6376 (invalid DKIM), RFC 7489 (DMARC misalignment). These headers are reported to the hosting company; the host appears unresponsive and spam continues. Abuse/complaint email: [email protected] (APNIC WHOIS). Alternate abuse/ops email seen for this netblock: [email protected] Phone: +82-2-6925-5046 (Hostcenter IP manager contact) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.133	12 Aug 2025	Received Aug 12, 2025 09:24:25 EDT. Unsolicited gambling/“casino bonus” blast with subject “400% Bon ... show more Received Aug 12, 2025 09:24:25 EDT. Unsolicited gambling/“casino bonus” blast with subject “400% Bonus up to €2000 + 145 Free Spins.” Message uses multiple mismatched identities (Return-Path equanting.biz; From yj5mr9.xst0nj.n8sj78.us; envelope via debauchy.org [27.255.77.133]) and obfuscated redirect links (including Google storage/redirectors) that attempt to lure the recipient to promo/phishing pages and credential “account reset” bait. Auth results: SPF=pass (equanting.biz), DKIM=permerror (no key), DMARC=not present/unaligned. Violates CAN-SPAM (15 U.S.C. §7701 et seq.; deceptive headers/unsolicited), 18 U.S.C. §1343 (wire fraud) and may implicate 18 U.S.C. §1030; conflicts with RFC 5322 (header consistency), RFC 6376 (DKIM), RFC 7489 (DMARC). Prior complaints ignored; spam continues. Hosting provider contact for 27.255.77.133: • Company: Hostcenter (EHOSTIDC Co., Ltd.) — Tel: +82-2-3478-8752 — Email: [email protected] APNIC abuse IRT for this range: [email protected] show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 160.202.162.72	12 Aug 2025	Received Aug 12, 2025 09:18:56 -0400. Unsolicited casino marketing with “exclusive welcome bonus/Pla ... show more Received Aug 12, 2025 09:18:56 -0400. Unsolicited casino marketing with “exclusive welcome bonus/Play Now” and obfuscated HTML, plus embedded “confirm your email” links suggesting credential-harvesting. Source per last trusted Received: 160.202.162.72 (stoltenberg.melviral.com.se) delivered to Gmail via TLS. Auth: SPF PASS for return@…existenoic.com but misaligned with header.from mtqost.zc0b3o.lmexik.us; DKIM PERMERROR (no key for d=mtqost…); DMARC alignment failure inferred. Message-ID appears added by Gmail (SMTPIN_ADDED_MISSING) → original lacked a valid ID. Violations: CAN-SPAM (15 U.S.C. §7701 et seq.; misleading headers/unsolicited marketing) and potential wire-fraud attempt via phishing (18 U.S.C. §1343). RFCs: 5322 §3.6.4 (missing Message-ID), 6376 (DKIM permerror), 7489 (DMARC misalignment), 7208 (SPF alignment). This IP/network continues to send similar mail despite complaints to the host; spam persists. Nurihosting / Hostcenter (AS45382). Abuse: [email protected] • +82-70-4291-6901. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 192.254.126.73	12 Aug 2025	Received 12 Aug 2025 10:08 UTC. Unsolicited bulk marketing from “Lead Onion” claiming “70K in revenu ... show more Received 12 Aug 2025 10:08 UTC. Unsolicited bulk marketing from “Lead Onion” claiming “70K in revenue / 5:1 ROI,” delivered to a corporate mailbox with no prior relationship. Message routed from o37.ptr5409.zym.ai [192.254.126.73] through Microsoft O365; SCL=5/CAT=SPM. SPF=pass, DKIM=pass (d=leadonion.co.uk), DMARC=pass; no obvious RFC 5321/5322 violations—the issue is unsolicited bulk and persistence. This appears non-compliant with anti-spam laws (CAN-SPAM, 15 U.S.C. §7701 et seq.) if sent without consent and continuing after complaints; may also contravene PECR/e-privacy rules when sent without consent. Full headers reported to the host. Please investigate and stop the sender. Host for 192.254.126.73: SendGrid, Inc. Abuse: [email protected], +1-888-985-7363. Prior complaints ignored; spam continues, indicating the host disregards abuse. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇺🇸 198.244.50.100	12 Aug 2025	Received on Aug 12, 2025 08:02:24 UTC. Unsolicited commercial email titled “Coming Soon: Higher Ener ... show more Received on Aug 12, 2025 08:02:24 UTC. Unsolicited commercial email titled “Coming Soon: Higher Energy Bills Based on Wealth?” sent via Mailgun infrastructure (198.244.50.100 / a100.a926d550.use4.send.mailgun.net) with marketing workflow/tracking tags. Office 365 flagged it: SCL=9 (high spam). Authentication shows SPF=pass, DKIM=pass (send.certifiedrenewables.com), DMARC=pass—so not spoofed, just unsolicited bulk. Likely violates CAN-SPAM (15 U.S.C. §7704) absent prior consent; no obvious RFC 5321/5322 violations found. Persistent stream despite complaints—provider appears unresponsive. Network owner: Mailgun Technologies Inc. Abuse desk: [email protected] / [email protected], phone +1-888-571-8972. Requested action: investigate sender ‘send.certifiedrenewables.com’ usage and terminate spam. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇺🇸 2a00:1450:4864:20::142	12 Aug 2025	Received Mon, 11 Aug 2025 12:24:22 UTC. Unsolicited commercial email advertising an HR/AI event ("Ex ... show more Received Mon, 11 Aug 2025 12:24:22 UTC. Unsolicited commercial email advertising an HR/AI event ("Explore Recruiter AI at Transform HR 2025") sent to our business inbox without prior relationship. Path shows Gmail API (gmailapi.google.com) relayed via Google MTA 2a00:1450:4864:20::142 into Microsoft 365. Auth results: SPF=none for globehireconnect.org; DKIM=pass (globehireconnect.org); DMARC=bestguesspass/action=none; SCL=5 (flagged spam). This appears to violate CAN-SPAM (15 U.S.C. §7701 et seq.) due to unsolicited marketing and likely lack of compliant opt-out/physical address (not observed in headers). RFC notes: poor authentication posture (SPF absent per RFC 7208; DMARC policy not enforced per RFC 7489). No obvious RFC 5321/5322 syntax violations observed. Headers forwarded to the host; spam continues, indicating no meaningful remediation. Abuse POC for sending IP (Google LLC): [email protected], +1-650-253-0000. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.134	12 Aug 2025	Received Tue, Aug 12, 2025 08:27:04 EDT. Unsolicited gambling/casino promotion (“WELCOME BONUS 400% ... show more Received Tue, Aug 12, 2025 08:27:04 EDT. Unsolicited gambling/casino promotion (“WELCOME BONUS 400% up to €2000 + 200 free spins”) using multiple cloaked redirects hosted on Google Cloud Storage to drive sign-ups. Sender used a randomized From domain and different Return-Path and HELO domains (genough.com / pollocause.org), indicating domain misalignment and deceptive origin. SPF: pass for genough.com (27.255.77.134). DKIM: none observed. DMARC: none observed. Message-ID uses “localhost.localdomain” (not globally unique), contrary to RFC 5322 best practices; lack of alignment undermines DMARC (RFC 7489) goals. May violate CAN-SPAM (15 U.S.C. §7701 et seq.) due to unsolicited commercial email, deceptive headers, and no clear opt-out. Abuse/Network: [email protected]. bgpview.io +1 Registry IRT: [email protected] (KRNIC abuse mailbox). whois.ipip.net Published contacts: [email protected] (listed on KRNIC’s abuse contact list), phone +82-2-6925-5046. show less	Phishing Web Spam Email Spam Spoofing Exploited Host
🇹🇷 78.135.85.171	12 Aug 2025	Received Aug 12, 2025 03:31:30 -0700 (PDT). Message delivered from ratke.cursionals.com [78.135.85.1 ... show more Received Aug 12, 2025 03:31:30 -0700 (PDT). Message delivered from ratke.cursionals.com [78.135.85.171]. Content is an unsolicited gambling promo (“Funbet — 100% up to $750 + 200 FS”) with multiple tracking redirects (incl. Google Cloud Storage), HTML-only body, and a forged Reply-To at a university subdomain; clearly bulk/unsolicited marketing. Auth: SPF=pass for return@…richaract.com via 78.135.85.171; DKIM=none/not present; DMARC=none/not observed (no alignment). Received chain shows ip6-localhost and localhost.localdomain/qmail IDs and an “X-Google-Sender-Delegation: Trusted Sender” claim—indicative of header manipulation. Hosting: IP belongs to HOSTING DUNYAM BILISIM TEKNOLOJILERI TICARET LIMITED SIRKETI (AS212219). Abuse: [email protected]. Laws/RFCs: CAN-SPAM (deceptive headers, unsolicited advertising), UCE; RFC 5321/5322 (misleading headers), 6376/7489 (no DKIM/DMARC). Prior complaints ignored; spam continues from this network. (AS212219 “Hosting Dunyam”) confirmed via IP data show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.3.139.187	12 Aug 2025	Received Tue, 12 Aug 2025 02:48:00 -0700. Phishing/unsolicited bulk mail posing as a “confirmation”/ ... show more Received Tue, 12 Aug 2025 02:48:00 -0700. Phishing/unsolicited bulk mail posing as a “confirmation”/“Top Stories” notice with obfuscated HTML and fake account/payment prompts. Display name spoofed the recipient’s name in From. Sending IP 50.3.139.187 (hansen.sourers.com, AS62904 Eonix); additional hop seen 173.228.155.53 (sailthru). Auth: SPF pass for blackcockzzzs-jouncyss.balkland.jp.net but not aligned with From; DKIM permerror (no key) for 7etuaq.0pnaa4.2wglzy.us; DMARC none/absent. Violates messaging norms incl. RFC 5322 (misleading From), RFC 6376 (broken DKIM), RFC 7489 (no DMARC), and DMARC/SPF alignment expectations. Unlawful under CAN-SPAM (15 U.S.C. §7701 et seq.) and indicative of wire-fraud intent (18 U.S.C. §1343). All headers reported to the host; spam keeps coming and the host appears not to act. Please investigate and terminate abuse at the source. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 178.162.185.71	11 Aug 2025	Received Aug 11, 2025 at 15:48:54 -0700 (PDT). Unsolicited bulk ad for “EnergyBillCruncher” with sub ... show more Received Aug 11, 2025 at 15:48:54 -0700 (PDT). Unsolicited bulk ad for “EnergyBillCruncher” with subject “Your Home May Qualify for Up to 70% Energy Savings—Check Now.” Links push a “Learn More” CTA; message pretends to be a delivery-status report (multipart/report) while actually marketing. Auth: SPF pass for envelope [email protected]; DKIM: none shown; DMARC: not shown; From domain (dqzbgcnzdk.us) does not align with SPF domain. Sending IP to Google: 178.162.185.71 — LeaseWeb Netherlands B.V. ([email protected]). Upstream MTA: 173.228.155.53 njmta-53.sailthru.com — NYI / The New York Internet Company ([email protected]). Likely CAN-SPAM violations (15 U.S.C. §7701 et seq.) for unsolicited commercial email with deceptive headers/subject and unclear sender; also abuses standards (RFC 5322 headers; misuse of multipart/report; DMARC RFC 7489 misalignment). Headers reported to the hosting companies; spam continues, indicating the host ignores complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.121.83	11 Aug 2025	Received Mon, Aug 11, 2025 14:12:45 PDT by Gmail from mraz.epicechox.de [162.211.121.83] (AS30083 ve ... show more Received Mon, Aug 11, 2025 14:12:45 PDT by Gmail from mraz.epicechox.de [162.211.121.83] (AS30083 velia.net). Return-Path uses a fabricated subdomain of temporational.de. Sending host appears to relay a mass-mail shot with subject in German about “KI” trading profits. Message is bulk promotional/financial bait with obfuscated links (Google storage/redirectors) and random filler, presented as multipart/report though not a bounce. Reply-To points at a made-up uic.edu subdomain. Content invites the recipient to click for “trader” access and unsubscribe text is non-functional. Auth: SPF pass for a throwaway subdomain; DKIM: none; DMARC: not present. Header irregularities indicate spoofing/forgery (RFC 5321/5322), misuse of multipart/report (RFC 3462/6522). Violates U.S. CAN-SPAM (15 U.S.C. §7701 et seq.)—unsolicited commercial email, misleading headers, no valid physical address/functional opt-out. Provider: velia.net; [email protected]. Ongoing waves suggest the host ignores abuse reports. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host