synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇸 104.206.82.62	10 Aug 2025	Received Sat, 09 Aug 2025 14:50:55 -0700, this phishing email was sent from mail server bernier.yaro ... show more Received Sat, 09 Aug 2025 14:50:55 -0700, this phishing email was sent from mail server bernier.yaroshones.com using IP 104.206.82.62. The message falsely claimed to be from “GmailSupportTeam” and fraudulently used the recipient’s name in the From field. It threatened imminent account closure to coerce the recipient into clicking a malicious link, a common credential-harvesting tactic. Content contained deceptive HTML and false urgency to bypass rational decision-making. Header analysis shows SPF passed, but DKIM failed with a permanent error (no valid key), and DMARC alignment failed due to DKIM failure. This violates CAN-SPAM Act (15 U.S.C. §7701), Computer Fraud and Abuse Act (18 U.S.C. §1030), and multiple RFC standards, including RFC 5321/5322 (header integrity). The spam also breaches ICANN policies on domain abuse. The sending IP is hosted by SSD Blaze LLC. Both originating IP and mail server IP are the same: 104.206.82.62. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.61	09 Aug 2025	Received Sat, 09 Aug 2025 14:03:54 -0700, this unsolicited bulk email promotes a fake “Johns Hopkins ... show more Received Sat, 09 Aug 2025 14:03:54 -0700, this unsolicited bulk email promotes a fake “Johns Hopkins 9-second neuropathy cure” via misleading medical claims and embedded tracking/redirect links. The “From” field used the recipient’s name falsely to impersonate trust, violating RFC 5321/5322 addressing rules. Message originated from sending IP 104.206.82.61 (gleichner.yaroshones.com) with additional relay 173.228.155.53 (njmta-53.sailthru.com). SPF passed, but DKIM failed (permerror – no valid key) and DMARC validation failed, indicating sender spoofing. HTML body contains deceptive health offers, likely affiliate scams, and attempts to solicit clicks to external domains. This violates CAN-SPAM Act (false/misleading header info, deceptive subject) and potentially FTC truth-in-advertising laws. All headers have been reported to the hosting provider, but spam persists, indicating the host ignores complaints. Complaints to host bounce back as undeliverable. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.79.61.145	09 Aug 2025	Email received Sat, 09 Aug 2025 13:59:14 -0700 contained a fraudulent “direct deposit” notice for $1 ... show more Email received Sat, 09 Aug 2025 13:59:14 -0700 contained a fraudulent “direct deposit” notice for $13,963.99, impersonating a well-known payment service to lure the recipient into clicking malicious links. From field used the recipient’s name falsely to increase trust. The sending IP was 51.79.61.145 via mail server atweel.structuremotionless.org.uk, later relayed through 173.228.155.53. SPF passed, but DKIM failed with “permerror” and no valid key; DMARC alignment failed due to DKIM failure. Headers and content indicate phishing, spoofing, and financial fraud intent, violating CAN-SPAM Act, CFAA, and wire fraud statutes. Message also violates RFC 5321/5322 for misleading header information. All evidence reported to the hosting company (OVH SAS), which has ignored prior abuse reports, as spam from this source continues unabated. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 195.154.42.232	09 Aug 2025	Email received Sat, 09 Aug 2025 13:25:28 PDT contained a fraudulent “Final Chance Payout” lure claim ... show more Email received Sat, 09 Aug 2025 13:25:28 PDT contained a fraudulent “Final Chance Payout” lure claiming $8,613.94 would expire in 24 hours, directing recipient to malicious links. The From field used the recipient’s name falsely, attempting to impersonate a trusted source. Content included deceptive HTML and obfuscated tracking URLs to bypass filters. Header analysis shows SPF pass but DKIM permanent error (no key found) and DMARC not aligned, indicating sender spoofing. Originating IP 195.154.42.232 (Poneytelecom/Online.net) delivered via coopersity.org, with sending mail server 173.228.155.53 (sailthru.com). This violates CAN-SPAM, wire fraud, and anti-phishing laws, and breaches RFC 5321/5322 by falsifying header fields. All spam from this range is reported to the hosting provider, but complaints are ignored and the abuse continues. This is a deliberate, repeated phishing and fraud campaign exploiting compromised infrastructure to target recipients with monetary scams. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.62	09 Aug 2025	Received on Sat, 09 Aug 2025 13:23:03 PDT – abusive message reports a “direct deposit of $14,865.94” ... show more Received on Sat, 09 Aug 2025 13:23:03 PDT – abusive message reports a “direct deposit of $14,865.94” from a sender impersonating you (the "From:" field mirrors your name falsely). The email body contains garbled content and a misleading unsubscribe prompt—clearly deceptive, with malicious intent. SPF passed, indicating the sending IP (104.206.82.62) is authorized for that domain, while DKIM failed with a “no key for signature” permerror. DMARC is implicitly failing due to DKIM failure and lack of alignment. The host’s mail server (bernier.yaroshones.com / 104.206.82.62) continues sending these spam messages despite complaints, showing blatant disregard for abuse reports. Content suggests Email Spam, with strong indicators of Phishing or Spoofing (impersonation of your name and false deposit claim). Laws violated may include CAN-SPAM Act (false or misleading headers, deceptive content), and possibly Computer Fraud and Abuse notions—plus RFC violations show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇸🇬 45.125.194.165	09 Aug 2025	Received at Sat, 09 Aug 2025 11:28:27 (PDT) – the header indicates the message originated from IP 45 ... show more Received at Sat, 09 Aug 2025 11:28:27 (PDT) – the header indicates the message originated from IP 45.125.194.165 (tutuappandroid.net) and passed through uxjk…phospita.com without revealing the country of origin. The "From" field impersonated you (“used the recipient’s name as false”), a deceptive practice. SPF passed, DKIM failed (permerror: “no key for signature”), and DMARC was not applied or failed to authenticate. The content is a bogus direct deposit notification claiming you received $13,963.99, followed by unclear alphanumeric data, “Top Stories of the Day,” and an “unsubscribe” note. It is clearly spam, likely phishing or scam content. The host shows blatant disregard for abuse complaints — spam continues unabated, signaling no enforcement or concern on their part. Reportable violations include Email Spam, Spoofing (false sender identity), Phishing (fraudulent money deposit claim), plus potentially DNS-related abuse if the sender domain is compromised. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 51.15.5.98	09 Aug 2025	Received on Sat, 09 Aug 2025 11:12:37 -0700 (PDT); the envelope-from “From:” field falsely used the ... show more Received on Sat, 09 Aug 2025 11:12:37 -0700 (PDT); the envelope-from “From:” field falsely used the recipient’s name—an obvious spoofing attempt. The header shows SPF passed, DKIM not present, and DMARC alignment cannot be confirmed due to absence of DKIM and no explicit DMARC result. This message appears to be unsolicited email spam with misleading header information and no legitimate unsubscribe link visible—both violations of the CAN-SPAM Act of 2003 (false header, lack of consent). It also breaches basic RFC 5322 rules regarding accurate From: fields and RFC 7489 (DMARC) expectation for alignment. The continuing flow despite complaints indicates the mail server host ignores abuse reports. Sending IP was 51.15.5.98 (pianishers.net), with mail relayed through the mail server at 173.228.155.53 (njmta-53.sailthru.com). The host shows blatant disregard for spam complaints as messages keep coming nonstop. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 195.154.42.232	09 Aug 2025	Received on Sat, 09 Aug 2025 14:07:29 -0400, this unsolicited bulk email is a fraudulent gambling/ca ... show more Received on Sat, 09 Aug 2025 14:07:29 -0400, this unsolicited bulk email is a fraudulent gambling/casino spam falsely claiming the recipient has won $7,546.94 and must confirm before a deadline. The “From” field used the recipient’s name as false to deceive, with misleading financial claims intended to lure victims into clicking malicious links. The sending IP is 195.154.42.232, mail server identified as coopersity.org (Poney Telecom / Online S.A.S). SPF passed, but DKIM failed with a permanent error (no key found), and DMARC alignment failed. The email is part of an ongoing pattern of spam from this host, indicating they ignore abuse reports and allow continued distribution. The message violates U.S. CAN-SPAM Act by sending deceptive unsolicited commercial content without consent, as well as international anti-spam and fraud laws. It also violates RFC 5321/5322 by forging header information and misrepresenting the sender. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 131.226.2.55	09 Aug 2025	Received on 09 Aug 2025 at 10:43:49 PDT. The From field impersonates your name, a clear case of dece ... show more Received on 09 Aug 2025 at 10:43:49 PDT. The From field impersonates your name, a clear case of deceptive sender identity. The sending IP is 131.226.2.55; the mail server IP is likewise the same. SPF passed, but DKIM failed due to a missing key (permerror), and DMARC is implicitly failing or not enforced—no valid DKIM signature exists, indicating authentication issues. The content falsely claims you "received a direct deposited of $13,963.99 No Deposit Required" and attempts to present itself as a system-generated notification—this is classic email spam and phishing attempt. The host continues to send these despite complaints, showing clear disregard for abuse reports. This activity violates CAN-SPAM (false header information, misleading subject, lack of opt-out compliance) and also breaches RFC 5321 (forged envelope sender), RFC 5322 (forged From header), plus DMARC failure is evident. The behavior fits best under the category of Email Spam and Spoofing. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 94.72.163.58	09 Aug 2025	Received on 09 Aug 2025 at 10:34:21 (PDT) – Sending IP: 94.72.163.58; mail server IP also 94.72.163. ... show more Received on 09 Aug 2025 at 10:34:21 (PDT) – Sending IP: 94.72.163.58; mail server IP also 94.72.163.58. Summary: The email spoofed the recipient’s name in the “From” field, falsely claiming to be a Gmail support team subscription termination warning, urging renewal within 48 hours and urging “Secure Your Device” action via a link. The content is clearly phishing and deceptive, implying urgency to manipulate the recipient into clicking. SPF passed, while DKIM failed with a permanent error (no key found), and no DMARC alignment is evident in the header. The host appears indifferent to repeated spam complaints, as the spam persists despite prior reports. This campaign likely violates anti-spam statutes such as CAN-SPAM (misleading headers, deceptive subject/content) and possibly FTC Act provisions against deceptive practices, as well as RFC 7208 (SPF), RFC 6376 (DKIM), and RFC 7489 (DMARC) guidelines on email authentication. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 212.83.186.164	09 Aug 2025	Received Sat, 09 Aug 2025 10:31:35 (PDT). The email impersonates legitimate support by claiming a “s ... show more Received Sat, 09 Aug 2025 10:31:35 (PDT). The email impersonates legitimate support by claiming a “subscription termination” and uses alarmist language (e.g. “Final Warning,” “secure your device”) to pressure renewal. The sender spoofed the recipient’s name in the From field (false use of recipient’s name). It contains a deceptive “Account Details” table, urgent tone, and embedded redirect links disguised as protective action. SPF passed, but DKIM resulted in a permanent error (“no key for signature”), and DMARC likely failed or wasn’t aligned (given DKIM permerror and spoofing). The sending IP is 212.83.186.164, and the mail server host is nexusedgehypertide.co.in. It is clear the host disregards spam complaints, as unwanted messages continue despite reporting. This unsolicited deceptive message violates anti-spam laws (e.g., CAN-SPAM Act for false header info, misleading subject/content) and breaches RFC 5322 (spoofed headers) and RFC 7208/7489 (SPF/DKIM/DMARC alignment requirements). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇷🇴 89.41.182.193	09 Aug 2025	Email received on Sat, 09 Aug 2025 at 09:43:40 PDT promoted a deceptive CarShield “free quote” offer ... show more Email received on Sat, 09 Aug 2025 at 09:43:40 PDT promoted a deceptive CarShield “free quote” offer using misleading claims of saving thousands on repairs. The sender exploited a falsified “From” field that used the recipient’s name without consent, masking the true origin. Message contained aggressive marketing, embedded tracking links, and potential affiliate redirects, attempting to lure recipients to third-party sites. Content designed to bypass spam filters with obfuscated HTML. SPF passed, but DKIM and DMARC validation were absent, indicating possible spoofing or unauthorized use of domain. Header analysis shows sending IP 89.41.182.193 (bartell.bdaymhjewerlyshop.com) relayed through infrastructure linked to 173.228.155.53. This violates CAN-SPAM Act provisions against deceptive headers and unsolicited commercial email, as well as potential wire fraud statutes. Technical violations include RFC 5321/5322 for header falsification and RFC 7208 misuse of SPF alignment. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 212.83.186.164	09 Aug 2025	Received on Sat, 09 Aug 2025 09:37:53 -0700, this email is a fraudulent phishing attempt disguised a ... show more Received on Sat, 09 Aug 2025 09:37:53 -0700, this email is a fraudulent phishing attempt disguised as a "Gmail Support Team" subscription termination notice. The sender falsified the From field to use the recipient's name, attempting to trick the user into clicking malicious Google Cloud Storage links leading to credential-harvesting pages. The HTML email is crafted to appear urgent, claiming account closure within 48 hours unless action is taken. SPF passed, but DKIM failed with “no key for signature” and DMARC evaluation shows misalignment, indicating forged sender information. The body contains social engineering tactics, hidden links, and excessive unrelated filler to evade spam filters. Embedded links redirect to phishing pages designed to steal login credentials. Sending IP: 212.83.186.164 (mail server: nexusedgehypertide.co.in) is repeatedly used for similar abuse. The host (Online S.A.S./Scaleway) has been notified multiple times, but spam persists, showing no action has been taken. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 78.159.102.165	09 Aug 2025	Received Sat 9 Aug 2025 09:28:55 -0700 (PDT). The header shows the email originated from IP 78.159.1 ... show more Received Sat 9 Aug 2025 09:28:55 -0700 (PDT). The header shows the email originated from IP 78.159.102.165 (miller.entrole.com). SPF passed, but there is no indication of a valid DKIM signature and no DMARC policy enforcement evident. The “From” field impersonates your name without authorization, using it fraudulently. The message subject falsely promises a large cash deposit (“Sie haben eine direkte Einzahlung €12.500,00 + 200 Freispiele”), but the body only contains irrelevant placeholder content (“Top Stories of the Day: Sep 0, 2019” etc.), making it a deceptive phishing-style lure likely aiming to trick the recipient. The host clearly disregards abuse complaints as identical spam keeps arriving. This activity likely violates anti-spam and consumer protection laws (e.g., CAN-SPAM Act in the US, GDPR/UK regulations where applicable), and breaches RFC 5322 (improper header “From” spoofing) and RFC 6376/7489 (lack of DKIM/DMARC). It clearly falls under Email Spam and Spoofing. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 195.154.42.232	09 Aug 2025	Email received on Sat, 09 Aug 2025 08:55:09 -0700. Message was a phishing attempt impersonating a we ... show more Email received on Sat, 09 Aug 2025 08:55:09 -0700. Message was a phishing attempt impersonating a well-known company, falsely warning that the recipient’s Apple ID may be suspended. The “From” field used the recipient’s own name in a deceptive manner. Message contained misleading HTML and obfuscated text designed to evade filters, pushing the victim toward malicious links. SPF passed, but DKIM failed with permerror (no valid key found), and DMARC alignment failed as a result. Sending IP was 195.154.42.232 via host coopersity.org, relayed through multiple servers including 173.228.155.53. This violates U.S. CAN-SPAM Act, Computer Fraud and Abuse Act (CFAA), and potentially wire fraud statutes. The use of falsified headers breaches RFC 5321 and RFC 5322 by forging “From” identity and misrepresenting source domains. Content and structure are consistent with credential-harvesting phishing campaigns. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇹🇷 154.52.125.203	09 Aug 2025	Received on 09 Aug 2025 01:57:33 PDT. Unsolicited gambling-related spam with subject "100 spins on t ... show more Received on 09 Aug 2025 01:57:33 PDT. Unsolicited gambling-related spam with subject "100 spins on the house!!". Message contains deceptive promotional claims, random filler text, and hidden unsubscribe links to evade detection. The From field falsely used the recipient’s name to mislead. Authentication: SPF passed, DKIM failed (permerror; no key for signature), DMARC not present/enforced. IPs involved: Sending IP 107.155.113.42 (ColoCrossing, ASN 36352, reverse DNS: 107-155-113-42.static.hvvc.us) and downstream mail-server IP 173.228.155.53 (Sailthru). ColoCrossing has a known history of spam-originating IPs and appears unresponsive to complaints. Likely violations include CAN-SPAM (false/misleading headers, deceptive subject, ineffective unsubscribe), US-CFAA § 1030 (impersonation), and RFC 5321/6376 failures. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 23.95.194.230	09 Aug 2025	Date/Time Received: 09 Aug 2025 01:57:33 PDT Subject: "100 spins on the house!!" S ... show more Date/Time Received: 09 Aug 2025 01:57:33 PDT Subject: "100 spins on the house!!" Sending IP: 107.155.113.42 (reverse DNS: 107-155-113-42.static.hvvc.us, ASN 36352) Downstream Mail Server IP: 173.228.155.53 (Sailthru) Abuse Type: Unsolicited commercial email promoting gambling offers, containing misleading subject lines, random filler text, and hidden unsubscribe links. Impersonation: The “From” field falsely used the recipient’s name. SPF/DKIM/DMARC: SPF passed, DKIM failed (permerror, no key for signature), DMARC not present/enforced. This activity appears to violate CAN-SPAM (false/misleading headers, deceptive subject, ineffective unsubscribe) and relevant RFCs (5321, 6376). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 163.172.72.56	09 Aug 2025	Received on 09 Aug 2025 01:57:33 PDT. The unsolicited email titled "100 spins on the house!!" is a s ... show more Received on 09 Aug 2025 01:57:33 PDT. The unsolicited email titled "100 spins on the house!!" is a spam promotion using deceptive subject lines and random filler content. Hidden unsubscribe links and misleading claims aim to trick the recipient into clicking. The From field falsely used the recipient’s name to mislead. Authentication: SPF passed, DKIM failed (permerror; no key for signature), DMARC not present/enforced. IPs involved: Sending IP 107.155.113.42 (Hivelocity Inc., ASN 29802, reverse DNS: 107-155-113-42.static.hvvc.us) and downstream mail-server IP 173.228.155.53 (Sailthru). Host appears unresponsive to prior spam complaints. Likely violations: CAN-SPAM (false/misleading headers, deceptive subject, invalid unsubscribe), US-CFAA § 1030 (impersonation), RFC 5321 (forged From), RFC 6376 (DKIM failure). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.49	09 Aug 2025	Received on 09 Aug 2025 07:06:47 EDT. The unsolicited email titled "Claim 55 free spins with CODE: F ... show more Received on 09 Aug 2025 07:06:47 EDT. The unsolicited email titled "Claim 55 free spins with CODE: FREE55?" is a spam promotion masquerading with gaming incentives. Its content is nonsensical, embedding “Top Stories” filler with random alphanumeric text and hidden unsubscribe links, designed to feign legitimacy while prompting engagement. Authentication results: SPF passed (domain designates 162.211.120.49 as permitted sender), DKIM failed with permerror (no key for signature), and DMARC is not present or enforced. IPs involved: sending IP 162.211.120.49 (“bayer.7yucca158.net”) under AS30083 (velia.net via GoDaddy) and downstream mail-server IP 173.228.155.53 (Sailthru). The host appears indifferent to spam complaints, as the spam persists unabated. This behavior likely contravenes CAN-SPAM (false/misleading headers, deceptive subject, unsub issues), potentially breaches US-CFAA § 1030 (impersonation), and violates RFC 5321 (forged From), RFC 6376 (DKIM integrity failure). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 107.155.113.46	09 Aug 2025	Received on 09 Aug 2025 05:16:36 (EDT). The unsolicited message, titled "400% BONUS + 30 SPINS", app ... show more Received on 09 Aug 2025 05:16:36 (EDT). The unsolicited message, titled "400% BONUS + 30 SPINS", appears as a phishing/spam promotion for online “games,” featuring nonsensical data, hidden unsubscribe mechanisms, and deceptive text—a clear attempt to lure engagement under false pretenses. Authentication checks: SPF passed (domain designates 107.155.113.46 as permitted sender), while DKIM failed with a permerror (no key for signature). DMARC is not present or enforced. IPs involved: sending IP 107.155.113.46 (harber.inspirituation.co.uk) and downstream mail-server IP 173.228.155.53 (Sailthru infrastructure); the host remains indifferent to repeated spam complaints as unsolicited messages continue unabated. This campaign violates anti-spam laws such as CAN-SPAM (false headers, deceptive subject, lack of valid unsubscribe) and may breach US-CFAA § 1030 (impersonation). It also contravenes RFC 5321 (forged From), RFC 6376 (DKIM integrity failure). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 107.155.113.42	09 Aug 2025	Received on 09 Aug 2025 01:57:33 (PDT). Summary: an unsolicited promotional email titled “100 spins ... show more Received on 09 Aug 2025 01:57:33 (PDT). Summary: an unsolicited promotional email titled “100 spins on the house!!” offering spins, with suspiciously random-looking content and a deceptive unsubscribe reference. The From field impersonates the recipient’s name. SPF authentication passed, but DKIM failed (permerror; no key for signature), and DMARC status is not present or non-compliant. Both the sending IP 107.155.113.42 and the downstream mail-server IP 173.228.155.53 are involved in delivering the spam. The hosting operator appears unconcerned with repeated spam reports, as the unsolicited messages continue despite complaints. Legally, this likely violates anti-spam regulations such as CAN-SPAM (false or misleading header information, deceptive subject lines, lack of effective unsubscribe mechanism) and potentially US Code § 1030 (fraudulent access/impersonation). It also breaches RFC 5321 (spoofed From header; DKIM failure) and RFC 6376 (DKIM integrity failure). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 167.86.103.231	09 Aug 2025	Received Fri, 08 Aug 2025 20:09:45 -0700. Email is a fraudulent spam message falsely claiming the re ... show more Received Fri, 08 Aug 2025 20:09:45 -0700. Email is a fraudulent spam message falsely claiming the recipient has won a "Mini Jeep" prize. The “From” field impersonated the recipient’s own name, a clear deceptive tactic to bypass spam filters and mislead. Content contains suspicious embedded links redirecting to external tracking or malicious sites, indicative of phishing intent. Message originated from IP 167.86.103.231 (mail server vmi2599742.contaboserver.net) relaying through 173.228.155.53. SPF passed, but DKIM and DMARC results are absent, indicating no cryptographic verification of authenticity. This violates multiple provisions of the CAN-SPAM Act, the U.S. Computer Fraud and Abuse Act, and email transmission standards including RFC 5321/5322 for header integrity. All evidence shows deliberate abuse of email infrastructure to send mass unsolicited messages, with malicious intent. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.50	09 Aug 2025	The spam email was received on Sat, 09 Aug 2025 at 06:49:08 PDT, using forged headers and impersonat ... show more The spam email was received on Sat, 09 Aug 2025 at 06:49:08 PDT, using forged headers and impersonating the recipient’s name in the “From” field. The subject line “3_Sex_Drive_Killers” was used to promote explicit and deceptive content, containing malicious links leading to external sites. The message includes both text and HTML parts designed to evade spam filters and lure the recipient into clicking unsafe URLs. Header analysis shows SPF passed, but DKIM failed with a permanent error (no key found), and DMARC was not aligned, indicating possible domain spoofing. The sending IP is 162.211.120.50, relayed through watsica.7yucca158.net. This transmission violates U.S. CAN-SPAM Act, FTC Act §5 (false/misleading header information), and multiple RFC standards (RFC 5321/5322). Despite prior reports, the host continues to ignore complaints, allowing ongoing abuse from their network. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.79.61.151	08 Aug 2025	This spam email, received Fri, 08 Aug 2025 14:39:53 -0700, uses deceptive tactics by forging the "Fr ... show more This spam email, received Fri, 08 Aug 2025 14:39:53 -0700, uses deceptive tactics by forging the "From" field to display the recipient’s own name falsely, attempting to trick them into opening it. The content promotes a fraudulent gambling offer with exaggerated “500% Welcome Bonus” claims, embedded malicious links, and misleading unsubscribe instructions. The body contains obfuscated text and tracking elements designed to evade detection. SPF passed, but DKIM failed with a permanent error (no key found), and ARC results indicate no authentication chain, suggesting sender forgery. DMARC is absent, enabling spoofing. This transmission violates CAN-SPAM Act provisions by sending unsolicited commercial content without valid consent, misrepresenting sender identity, and lacking a legitimate postal address. It also breaches multiple RFC standards, including RFC 5321 and RFC 5322, through header forgery and non-compliant formatting. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.59	08 Aug 2025	Received on Fri, 08 Aug 2025 09:16:24 PDT. The email header shows a suspicious message originating f ... show more Received on Fri, 08 Aug 2025 09:16:24 PDT. The email header shows a suspicious message originating from IP 104.206.82.59 (crona.yaroshones.com), with SPF passing but DKIM failing due to missing key, indicating a permerror. The From field uses the recipient's name falsely, attempting to impersonate a legitimate service ("®iCloud Storage®") with a highly suspicious domain and message-ID pattern. The email contains nonsensical content and a disguised unsubscribe link, typical of spam or phishing attempts. Despite SPF pass, DKIM failure and domain mismatches strongly suggest spoofing and Email Spam. The hosting provider has been repeatedly notified yet has not taken action, allowing spam to persist. Tick categories: Email Spam, Spoofing, Fraud Orders. This violates multiple RFCs including RFC 5321 (SMTP), RFC 7208 (SPF), and RFC 6376 (DKIM), as well as anti-spam laws such as CAN-SPAM Act. The host appears negligent in addressing abuse complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host