synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇫🇷 212.83.131.128	11 Aug 2025	Received Aug 11, 2025 06:15:28 PDT. Delivered to Gmail from 212.83.131.128 (miroving.nl). Subject pr ... show more Received Aug 11, 2025 06:15:28 PDT. Delivered to Gmail from 212.83.131.128 (miroving.nl). Subject promises a €2,000 “direct deposit” and funnels to “verification”/login pages via tracking/redirect links, with heavy obfuscated HTML and random filler—typical credential-harvesting spam. Display name impersonates the recipient; the From header used the recipient’s name falsely. Auth results: SPF PASS for the envelope domain via 212.83.131.128; DKIM PERMERROR (no key for the signing domain); DMARC not shown/alignment unknown in the header. Violations: CAN-SPAM (deceptive headers/subject, 15 U.S.C. §7704) and potential wire fraud (18 U.S.C. §1343); RFC 5322 header integrity issues; RFC 6376 DKIM failure; RFC 7489 DMARC absent/misaligned. Host for 212.83.131.128: Scaleway / Online SAS (AS12876), phone +33 1 84 13 00 00. Prior complaints to this host appear ineffective; spam continues. Host lookup sources (for your records): Scaleway/Online SAS owns the 212.83.131.0/24 range (AS12876) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.133	11 Aug 2025	Received Aug 11, 2025 at 08:14 EDT. Unsolicited bulk email carrying mixed “account confirmation/paym ... show more Received Aug 11, 2025 at 08:14 EDT. Unsolicited bulk email carrying mixed “account confirmation/payment verification” and casino promo content, randomized IDs, and credential-harvest links (incl. redirects) — clearly spam/phishing. The From field used the recipient’s name falsely. Header anomalies: SPF pass for envelope domain but non-aligned with header From; DKIM permerror/no key; DMARC fail/none shown; forged/mismatched Received chain (HELO debauchy.org vs envelope/domain); missing original Message-ID (added by Gmail); misuse of multipart/report for non-DSN. Violations: CAN-SPAM (15 U.S.C. §7701 et seq.—deceptive headers, no valid physical address, non-functional unsubscribe) and RFC 5322/5321/7489/6522 as noted. These headers have been reported to the hosting company; despite complaints, spam continues and the host appears unresponsive. Origin host for 27.255.77.133: Hostcenter/EHOSTIDC (AS45382), phone +82-2-6925-5046. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.2.188.218	11 Aug 2025	Received on Mon, 11 Aug 2025 04:38:02 -0700 (PDT). This email is a deceptive spam message falsely us ... show more Received on Mon, 11 Aug 2025 04:38:02 -0700 (PDT). This email is a deceptive spam message falsely using the recipient's name in the From field, aiming to trick and mislead the target into confirming a fabricated prize claim. The content is largely nonsensical or encoded gibberish, designed to bypass spam filters and encourage click-through on suspicious links. SPF validation passed, indicating the sending server is authorized to send on behalf of the domain, but DKIM and DMARC status are not present or not validated, suggesting weak or absent cryptographic authentication. The host, discussel.net (IP: 50.2.188.218), continues sending such spam despite repeated complaints, showing disregard for abuse reports. This activity violates US CAN-SPAM Act (15 U.S.C. §7701 et seq.) and relevant RFCs (RFC 5321, RFC 7208), by sending unsolicited commercial email and falsifying header information. Recommended categories: Email Spam, Spoofing, Fraud Orders. SpamCop complaints to [email protected] bounce back as undeliverable. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 163.172.72.56	11 Aug 2025	Received Mon, 11 Aug 2025 04:36:34 -0700. This email is unsolicited spam promoting a suspicious casi ... show more Received Mon, 11 Aug 2025 04:36:34 -0700. This email is unsolicited spam promoting a suspicious casino-themed message promising large monetary rewards. The "From" field uses the recipient’s name falsely, attempting to deceive. SPF passes, but DKIM signature is invalid (no key found), indicating a lack of proper domain authentication. DMARC status is unclear but likely fails due to DKIM issues. The message includes obfuscated and nonsensical text content, typical of spam campaigns. Despite multiple complaints, the host continues allowing this spam to be sent. T show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.3.139.190	11 Aug 2025	Received on Mon, 11 Aug 2025 02:51:09 PDT. The email claims to be from "'The-Casino-Team'" with a su ... show more Received on Mon, 11 Aug 2025 02:51:09 PDT. The email claims to be from "'The-Casino-Team'" with a suspicious domain and subject "400% Bonus up to €2000 + 145 Free Spins." The message is unsolicited promotional spam, containing misleading gambling offers. The From field uses the recipient's name falsely, impersonating a trusted contact. SPF check passes, indicating the sending IP 50.3.139.190 (murphy.sourers.com) is authorized by the spoofed domain, but DKIM fails due to missing public key. DMARC status is not explicitly stated but fails by implication. The hosting provider ignores repeated spam complaints as abuse continues unabated. This activity violates anti-spam laws such as CAN-SPAM Act (US) and relevant international anti-fraud regulations. RFC violations include spoofing and misleading header information. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.3.139.166	11 Aug 2025	Received on 11 Aug 2025 at 02:39:11 PDT. Sending IP: 50.3.139.166; mail server IP: 50.3.139.166. SPF ... show more Received on 11 Aug 2025 at 02:39:11 PDT. Sending IP: 50.3.139.166; mail server IP: 50.3.139.166. SPF passed (domain charlotte-aux-fraises.conceptibiotis.com authorized 50.3.139.166), DKIM permerror (signature failed, no key available), DMARC not explicit but likely failed. The email purports to be a “final warning” about subscription closure, referencing “Your Subscription will be Closed at Mon,11 Aug-2025 [ Final Warning ]” with minimal actual content—just “Top Stories of the Day” and an unsub link. It abuses the recipient’s name in the From field as though they were familiar; it’s clearly deceptive phishing-style content with no legitimate context. The host appears indifferent to repeated spam complaints as this persists unabated. Violations: unsolicited commercial/spam email, misleading header (“spoofing”), possible breach of CAN-SPAM Act (fraudulent subject, deceptive headers) and RFC 5321/5322 (false “From” and missing valid DKIM). Tick category: Email Spam / Phishing / Spoofing. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 110.172.101.64	10 Aug 2025	This unsolicited spam email originated from IP 110.172.101.64 via mail server torphy.discientarcraft ... show more This unsolicited spam email originated from IP 110.172.101.64 via mail server torphy.discientarcraft.jp.net, later relayed through 173.228.155.53 (njmta-53.sailthru.com). The "From" field falsely used the recipient’s name to appear legitimate. The content impersonates CashApp and other brands, attempting to trick the recipient into clicking phishing links under the guise of payment confirmation and account verification. Links redirect to malicious sites aimed at harvesting personal and financial credentials. The header shows SPF pass, DKIM permerror (no key), and DMARC not aligned, indicating sender domain forgery. The email violates U.S. CAN-SPAM Act, Computer Fraud and Abuse Act (CFAA), and wire fraud statutes, and breaches RFC 5321/5322 for forged headers and misleading addressing. The host has been repeatedly reported for similar spam, yet abuse continues unabated, demonstrating disregard for spam complaints. This is a clear phishing and fraud attempt sent through their infrastructure. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.161.73.164	10 Aug 2025	Received on Sat, 09 Aug 2025 13:25:28 PDT, this unsolicited email exhibits clear signs of spam and s ... show more Received on Sat, 09 Aug 2025 13:25:28 PDT, this unsolicited email exhibits clear signs of spam and spoofing. The message impersonates the recipient by using their name in the "From" field to mislead and gain trust. Content appears to be a fraudulent solicitation promoting questionable offers or links, attempting to deceive the reader into engagement. Email header analysis indicates SPF authentication failed, meaning the sending IP is not authorized to send on behalf of the claimed domain. DKIM signature verification failed, showing the email may have been altered in transit or was not signed by the claimed domain’s legitimate server. DMARC validation failed, confirming the message did not align with domain policies for authentication. These combined failures, along with the deceptive display name and unsolicited nature, strongly indicate malicious intent and an attempt to bypass filtering protections. LEGAL ACTION needs to be taken against this irresponsible host!! show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 212.83.131.111	10 Aug 2025	Received on Sun, 10 Aug 2025 15:11:20 -0700. Email is a fraudulent “CashApp” phishing scam designed ... show more Received on Sun, 10 Aug 2025 15:11:20 -0700. Email is a fraudulent “CashApp” phishing scam designed to deceive the recipient into clicking malicious links and providing personal/financial details. The “From” field impersonates the recipient’s name falsely. Content includes fake payment confirmation, fabricated account notices, and urgent instructions to verify or claim funds, linking to non-legitimate domains. SPF passed, but DKIM failed (permerror: no key found) and DMARC did not authenticate. Violates CAN-SPAM Act, U.S. wire fraud statutes, and international anti-phishing laws; also breaches RFC 5321/5322 by falsifying sender identity. Sent from IP 212.83.131.111 via host asthmus.net (mail server IP 173.228.155.53). Host has been repeatedly notified but ignores spam complaints, and similar phishing continues unabated. SpamCop complaints to [email protected] bounce as undeliverable. This host needs legal action taken against it. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 209.58.137.82	10 Aug 2025	Email received on Sun, 10 Aug 2025 at 14:05:21 PDT is a fraudulent phishing attempt disguised as a G ... show more Email received on Sun, 10 Aug 2025 at 14:05:21 PDT is a fraudulent phishing attempt disguised as a Gmail account termination warning. The “From” field used the recipient’s name falsely to appear legitimate. Message urges the recipient to click malicious links to “secure” their account, leading to credential harvesting sites. Content contains threatening language about subscription closure and fabricated account details to induce panic and immediate action. Header analysis shows sending IP 209.58.137.82 (mail server for warshalluk.com) with DKIM permerror (no valid key), SPF pass, and no DMARC alignment. The email originated from Sailthru infrastructure (173.228.155.53) before being relayed. This violates CAN-SPAM, the Computer Fraud and Abuse Act (CFAA), and multiple RFC standards including RFC 5321/5322 (header forgery, misleading addressing) and RFC 6376 (invalid DKIM). This IP continues sending repeated spam despite prior reports, indicating the host ignores abuse complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.161.73.167	10 Aug 2025	Received: Sun, 10 Aug 2025 13:14:06 -0700 (PDT). Summary: The message claims to offer free online co ... show more Received: Sun, 10 Aug 2025 13:14:06 -0700 (PDT). Summary: The message claims to offer free online consultation for ED (‘Start treating your ED’); it contains garbled alphanumeric tracking data and a deceptive unsubscribe instruction. The “From” field impersonates the recipient by using their name as the sender — a false “From.” SPF passed; DKIM failed with “permerror (no key for signature)”; DMARC status not explicitly stated, implying failure or misconfiguration. All headers have been reported to the mail server’s host, yet spam persists — seemingly no action is taken by the host. Infringements include unsolicited commercial email (CAN-SPAM Act violation in the U.S.), misrepresentation of the sender (RFC 5322 and RFC 5321 violations), and likely failure to honor unsubscribe requests (also CAN-SPAM). There is clear evidence of Spoofing and Email Spam. Sending IP: 51.161.73.167 (originating host littel.illigie.com). Mail server IP: 173.228.155.53. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.81	10 Aug 2025	Email received on Sun, 10 Aug 2025 10:30:56 -0700 from sending IP 162.211.120.81 via mail server app ... show more Email received on Sun, 10 Aug 2025 10:30:56 -0700 from sending IP 162.211.120.81 via mail server appealedical.com. The “From” field falsely used the recipient’s name to deceive the target. Message is a fraudulent spam claiming a direct deposit of $13,963.99 with no deposit required, using deceptive HTML formatting and embedded links to lure victims to malicious websites. Content is crafted to bypass filters with obfuscated text and images, aiming to trick recipients into clicking for personal/financial theft. SPF passed, but DKIM failed (permerror), DMARC not aligned. Violates U.S. CAN-SPAM Act, Computer Fraud and Abuse Act, and multiple RFC standards (RFC 5321/5322 – forged headers, misleading addressing). The sending host continues to relay spam despite prior complaints, showing disregard for abuse reports. Persistent abuse suggests negligent hosting oversight. Spam complaints sent to [email protected] bounce back to SpamCop as undeliverable. show less	Email Spam Spoofing
🇰🇷 27.102.106.145	10 Aug 2025	Received Sun, 10 Aug 2025 09:44:13 -0700 (PDT). Sending IP: 27.102.106.145 (bradtke.designatin.com). ... show more Received Sun, 10 Aug 2025 09:44:13 -0700 (PDT). Sending IP: 27.102.106.145 (bradtke.designatin.com). Mail server IP noted as 27.102.106.145. Owner appears to be DAOU-AS-KR (Daou Technology). Spam from “GmailSupportTeam <…@nidyrxxjtkbmyhvoxawbdvsv.com>”. Message is a phishing “subscription termination/final warning,” impersonating Gmail to scare the recipient into clicking “Secure Your Device.” Links route to a malicious page hosted under Google Cloud Storage. Content uses urgency, fake account details, and brand misuse to harvest credentials/payment. Auth: SPF pass for [email protected] (not aligned with From). DKIM permerror (no key). DMARC not present. Violations: CAN-SPAM (deceptive headers/content, no valid business address), 18 U.S.C. §1343 (wire fraud via phishing), RFC 5322 (misleading/mismatched From). All headers reported to the host; spam continues, indicating the host is unresponsive. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇮🇳 45.64.216.20	10 Aug 2025	Received Sun, 10 Aug 2025 08:50:03 -0700, this email is a phishing attempt impersonating “GmailSuppo ... show more Received Sun, 10 Aug 2025 08:50:03 -0700, this email is a phishing attempt impersonating “GmailSupportTeam” to deliver a fake subscription closure warning. The “From” field used the recipient’s name falsely to gain trust. The body contains alarming closure notices, urgent calls to click external links, and fabricated account details, intending to harvest credentials and personal information. SPF passed, but DKIM failed with a permanent error (no valid key), and DMARC failed as a result. The sending IP 45.64.216.20 (mail server sanbaata.com.de) appears tied to a spam operation and is repeatedly reported, showing the host ignores abuse complaints. Headers show multiple relay hops, with the originating server at 45.64.216.20 injecting deceptive messages into legitimate infrastructure. This violates CAN-SPAM, the Computer Fraud and Abuse Act (18 U.S.C. §1030), wire fraud statutes (18 U.S.C. §1343), and international anti-spam laws, and breaches RFC 5321/5322 by falsifying header fields. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 172.93.120.138	10 Aug 2025	Email received on Sun, 10 Aug 2025 at 08:43:12 -0700 is a fraudulent phishing attempt designed to im ... show more Email received on Sun, 10 Aug 2025 at 08:43:12 -0700 is a fraudulent phishing attempt designed to impersonate Gmail Support. The “From” field falsely used the recipient’s name to appear legitimate. Message threatens account closure unless the recipient clicks a malicious link hosted on Google Cloud Storage, leading to credential theft. SPF passed, but DKIM failed with “permerror,” and DMARC alignment failed due to missing valid DKIM signature. Message content contains scare tactics, false urgency, and embedded tracking/redirect links. This is a clear violation of the CAN-SPAM Act, the Computer Fraud and Abuse Act (CFAA), and anti-phishing provisions. Headers show it was sent via IP 172.93.120.138 (mail server for organicantly.org). This IP and domain are being abused to host and send high-volume phishing spam. The host has been repeatedly notified and continues to allow abuse with no visible action, enabling ongoing malicious campaigns. This spam attempts to harvest personal data under false pretenses. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 172.93.120.12	10 Aug 2025	Received Sun, 10 Aug 2025 08:36:43 PDT; sending IP: 172.93.120.12, mail server IP: same. The From fi ... show more Received Sun, 10 Aug 2025 08:36:43 PDT; sending IP: 172.93.120.12, mail server IP: same. The From field impersonated your name, using it as a false sender. SPF passed (domain designates 172.93.120.12 as permitted sender), DKIM failed with “permerror (no key for signature)”, and DMARC effectively failed due to the DKIM failure and no alignment. The email pretended to be a “subscription closing” warning, with generic nonsensical content (“Top Stories of the Day…unsubscribe”) and random strings, clearly phishing-style and fraudulent. Complaints to the host have gone unheeded—spam keeps arriving despite reports, suggesting the host either doesn’t care or is unresponsive to abuse. The offense falls squarely under Email Spam, Phishing, and Spoofing categories. It violates U.S. CAN-SPAM Act provisions against deceptive subject lines and falsified headers, and breaches RFC 5322 (header integrity) and RFC 7208 (SPF) alignment expectations. Same email sent from 5 different mail server IP's! show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.3.139.141	10 Aug 2025	Received Sun, 10 Aug 2025 08:28:32 -0700. Message is a phishing scam impersonating a Gmail Support T ... show more Received Sun, 10 Aug 2025 08:28:32 -0700. Message is a phishing scam impersonating a Gmail Support Team notice, falsely using the recipient’s name in the From field to threaten account closure unless the recipient clicks malicious links. Content urges urgent “subscription termination” review and contains obfuscated URLs leading to fraudulent sites designed to harvest credentials. SPF passes, but DKIM fails with permerror (no key for signature), and DMARC alignment fails due to DKIM failure. Violates U.S. CAN-SPAM Act, the Computer Fraud and Abuse Act (18 U.S.C. §1030), and multiple RFCs including RFC 5321/5322 for header integrity. Sending IP: 50.3.139.141 (upton.coordinanciful.com). Mail server IP observed: 173.228.155.53 (sailthru.com). The host has been repeatedly notified of similar abuse but continues to allow this activity without action, indicating disregard for spam complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.83	10 Aug 2025	Received Sun, 10 Aug 2025 07:11:56 -0700, this phishing email impersonates Gmail Support, falsely cl ... show more Received Sun, 10 Aug 2025 07:11:56 -0700, this phishing email impersonates Gmail Support, falsely claiming the recipient’s account will be closed and media deleted unless urgent action is taken. The From field fraudulently used the recipient’s own name to deceive. Links in the HTML direct to a malicious site disguised as Google, designed to harvest credentials. SPF passed, but DKIM and DMARC authentication results were not present or validated, indicating possible spoofing. Content violates CAN-SPAM, US wire fraud statutes, and anti-phishing laws, and breaches RFC 5321/5322 by falsifying origin identity. Sending IP: 27.255.77.83 (aposternal.com). Mail server IP: 173.228.155.53 (sailthru.com). This host ignores repeated spam complaints, allowing ongoing malicious campaigns as complaints using SpamCop bounce back as undeliverable. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.79.61.151	10 Aug 2025	Received Sun, 10 Aug 2025 06:15:43 -0700. Email is a deceptive health-related spam using the recipie ... show more Received Sun, 10 Aug 2025 06:15:43 -0700. Email is a deceptive health-related spam using the recipient’s name in the “From” field falsely to impersonate legitimacy. Message promotes dubious “neuropathy elimination” remedies, linking to multiple redirection URLs to solicit clicks for possible fraudulent products. Content is misleading, contains medical claims without substantiation, and is sent without consent. SPF shows “pass,” but DKIM failed with “permerror” (no valid key), and DMARC not aligned, indicating spoofing/forgery attempts. Headers reveal it originated from 51.79.61.151 (reed.structuremotionless.org.uk) via 173.228.155.53 (njmta-53.sailthru.com). Sending IP belongs to OVH Hosting, known for tolerating abuse despite ongoing complaints. Sending such unsolicited spam violates CAN-SPAM Act (U.S.), UK PECR, and potentially fraud statutes. RFC 5321/5322 violations include forged header fields and false sender identity. Host has ignored repeated 100+ spam complaints for various IP complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 178.162.185.71	10 Aug 2025	178.162.185.71 (owned by Leaseweb Deutschland GmbH) sent a deceptive bulk email on Sun, 10 Aug 2025 ... show more 178.162.185.71 (owned by Leaseweb Deutschland GmbH) sent a deceptive bulk email on Sun, 10 Aug 2025 05:45:25 -0700, using forged branding of StateFarm to lure the recipient into clicking fraudulent links. The “From” field falsely used the recipient’s own name to increase trust. Message contained misleading claims of a “free fire safety kit” contingent on completing a survey, leading to potentially malicious third-party sites. Content was mass-mailed in HTML format with obfuscated tracking links. The spam bypassed content filters using domain [email protected] with SPF pass, but DKIM and DMARC authentication results were absent, indicating non-compliance with email best practices. This constitutes a violation of the CAN-SPAM Act (15 U.S.C. §7701), fraud statutes, and RFC 5321/5322 provisions regarding header integrity and truthful origin representation. All headers are being reported to the host. Leaseweb has a history of ignoring repeated spam complaints from SpamCop. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 149.72.153.80	10 Aug 2025	Received Sun, 10 Aug 2025 05:35:06 -0700 from IP 149.72.153.80 (o10.mailer.shopify.com) via SendGrid ... show more Received Sun, 10 Aug 2025 05:35:06 -0700 from IP 149.72.153.80 (o10.mailer.shopify.com) via SendGrid/Shopify bulk mail system. Message promoted sexually explicit products with explicit descriptions and images, unsolicited and unrelated to recipient. The “From” field impersonated recipient’s name in a deceptive manner to appear as a legitimate contact. Header analysis: SPF PASS, DKIM PASS (g.shopifyemail.com, sendgrid.info), DMARC PASS. Despite authentication passing, message content is clear commercial spam violating CAN-SPAM Act (15 U.S.C. §7701) and potentially obscenity laws for sending explicit sexual content to a non-opt-in address. Also violates RFC 5321/5322 by misusing headers for deceptive identity. Host: IP 149.72.153.80 is owned by Message Systems / SendGrid (Twilio). This host ignores spam complaints; repeated abuse continues from same network without mitigation, indicating tolerance of ongoing spam operations. Won't accept any complaints at all from SpamCop. Blocked!!! show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.86	10 Aug 2025	Date/time received: Sun, 10 Aug 2025 07:19:32 -0400. Summary: The email falsely claims the recipient ... show more Date/time received: Sun, 10 Aug 2025 07:19:32 -0400. Summary: The email falsely claims the recipient has received $13,963.99 with no deposit required, adopts a deceptive “BANK_CHECK” style subject and sender name, and appears to use templated placeholders and gibberish content. The From field spoofs the recipient’s name. The message contains incoherent text and a misleading financial claim. SPF: pass; DKIM: not present; DMARC: not present or failed. The sending IP is 27.255.77.86, and the mail server’s IP is 173.228.155.53. The host appears indifferent to spam complaints as the unsolicited messages persist despite repeated reports to the hosting provider. Recommended category: Email Spam. Laws and RFC violations: likely violation of CAN-SPAM Act (false header, deceptive content), and RFC 5322 (misleading From), RFC 5321 and 7208 (SPF/DMARC absence or misleading configuration). No country included as it may be incorrect. Email complaints to host bounce back as undeliverable. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.3.139.164	10 Aug 2025	Email received on Sun, 10 Aug 2025 03:01:57 -0700 contained a phishing scam impersonating Gmail Supp ... show more Email received on Sun, 10 Aug 2025 03:01:57 -0700 contained a phishing scam impersonating Gmail Support, falsely using the recipient’s name in the From field. The message fraudulently claimed the recipient’s subscription would be closed unless urgent action was taken, urging them to click malicious links to “secure your device” and “verify your account.” Content included fabricated account details and threats of termination to induce panic. SPF passed, but DKIM failed (permerror, no key for signature) and DMARC failed alignment. This violates U.S. CAN-SPAM Act, Computer Fraud and Abuse Act, and anti-phishing laws. Sending IP: 50.3.139.164, mail server bins.syllabore.com. Host (IP owner) ignores ongoing spam complaints, allowing persistent abuse from their network. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇹🇷 193.8.113.231	10 Aug 2025	Received on 10 Aug 2025 at 05:29:50 UTC-4 (noting local email timestamp). The “From” field impersona ... show more Received on 10 Aug 2025 at 05:29:50 UTC-4 (noting local email timestamp). The “From” field impersonated the recipient’s name, misrepresenting the origin. SPF passed, DKIM not present/not signed (absent), and DMARC status unavailable—no alignment or enforcement seen. Summary: The message promotes a “Willkommensbonus 4 500 € BONUS + 350 Freispiele” with garbled multilingual content, random codes, and “unsubscribe” link—clearly unsolicited and promotional spam. The hosting provider seems indifferent to repeated spam complaints, as messages persist unabated. Sending IP: 193.8.113.231; mail server hostname: requencircuit.info (per header). This is classic Email Spam (unsolicited bulk promotional content) with impersonation and likely fraudulent incentive. Such unsolicited marketing breaches CAN-SPAM regulations (misleading headers, deceptive subject, no clear opt-out) and violates RFC 5322 header authenticity expectations (unauthenticated “From” impersonation). No other attack vectors detected. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.79.61.145	10 Aug 2025	Received on Sat, 09 Aug 2025 15:40:56 -0700, this unsolicited commercial email promotes “Leafguard” ... show more Received on Sat, 09 Aug 2025 15:40:56 -0700, this unsolicited commercial email promotes “Leafguard” with misleading subject lines promising deep discounts. The “From” field used the recipient’s name falsely to feign legitimacy. The message originated from mail server 51.79.61.145 (atweel.structuremotionless.org.uk) and was relayed via 173.228.155.53 (njmta-53.sailthru.com). SPF passed, but DKIM failed with permerror due to an invalid key, and ARC/DMARC authentication failed. The spam contains deceptive marketing, forged headers, and obfuscated unsubscribe links, violating CAN-SPAM, FTC truth-in-advertising rules, and RFC 5321/5322 email header standards. This constitutes a fraudulent commercial solicitation transmitted without consent. This IP’s host (OVH SAS) continues allowing abuse despite ongoing complaints, indicating disregard for anti-spam enforcement. Headers and sending patterns show persistent activity from the same network without mitigation. show less	Fraud Orders Web Spam Email Spam Spoofing Exploited Host