synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇸 159.112.241.41	08 Aug 2025	Received on Fri, 8 Aug 2025 07:45:07 UTC. The email originates from IP 159.112.241.41 (mailgun.net) ... show more Received on Fri, 8 Aug 2025 07:45:07 UTC. The email originates from IP 159.112.241.41 (mailgun.net) using Microsoft Outlook and Mailgun infrastructure. SPF, DKIM, and DMARC all passed, indicating authentication was not failed or spoofed. However, the message is unsolicited commercial email promoting content from support.danilomcgarry.com, sent to [email protected] without consent. The "From" field does not impersonate the recipient’s name. Despite valid authentication, this is clear Email Spam violating CAN-SPAM Act 2003 and RFC 5321/5322 for unsolicited bulk email. Complaints to the host have been ignored; spam continues unabated. The host is Mailgun Technologies Inc., contact: [email protected], phone +1-415-222-1122. Please categorize as Email Spam and Web Spam. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇺🇸 2607:f8b0:4864:20::943	08 Aug 2025	Received on Thu, 7 Aug 2025 11:29:49 +0000. The email originates from an IPv6 address associated wit ... show more Received on Thu, 7 Aug 2025 11:29:49 +0000. The email originates from an IPv6 address associated with Google’s mail servers but lacks a valid SPF record for hirewithinsight.org, showing SPF=none. DKIM signature from hirewithinsight.org passes verification, and DMARC shows bestguesspass with no enforcement. The email content promotes "Recruiter AI at Transform HR 2025," sent unsolicited to the recipient. The "From" field uses the recipient's name falsely, indicating potential social engineering. Despite multiple spam complaints to the hosting entity (Google/Alphabet Inc.), spam emails persist, indicating disregard for abuse reports. The host is Google LLC, phone +1-650-253-0000. Violations include RFC 5321 (prohibited use of mail relays), RFC 7208 (SPF misalignment), and anti-spam laws such as CAN-SPAM Act. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇺🇸 148.72.153.88	08 Aug 2025	Received: Fri, 08 Aug 2025 06:05:16 -0700 This spam email falsely used the recipient’s name in the ... show more Received: Fri, 08 Aug 2025 06:05:16 -0700 This spam email falsely used the recipient’s name in the "From" field to deceive the recipient and claimed a fake payment of $1,500 was successfully processed. The body content was typical spam with suspicious links, likely attempting phishing or malware redirection. The message originated from IP 148.72.153.88 and passed SPF, but DKIM failed with permerror and DMARC is not shown as passed, indicating potential spoofing. The return-path domain was crafted to resemble a trusted service but is fake. Headers suggest use of compromised servers and deceptive routing. Despite repeated complaints, the hosting provider has failed to take action, and the spam continues. This violates the CAN-SPAM Act, RFC 5322 (From field misuse), and likely wire fraud statutes. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇿 85.117.243.237	08 Aug 2025	Received on Fri, 08 Aug 2025 at 04:46:29 PDT, this deceptive email was sent from IP 85.117.243.237, ... show more Received on Fri, 08 Aug 2025 at 04:46:29 PDT, this deceptive email was sent from IP 85.117.243.237, with the mail server identified as eoferr.gslbukoxygen.dev. The message impersonated Gmail Support, falsely using the recipient’s name in the “From” field, and threatened account closure to induce panic. The subject line mimicked urgency: “Your Subscription will be Closed.” The email content includes long misleading blocks of obfuscated and random alphanumeric characters, fabricated unsubscribe links, and fake Google Docs and support portals. It appears crafted to phish personal data or install malware via embedded URLs. SPF passed, but DKIM failed (permerror: no key) and DMARC evaluation was missing, indicating poor or spoofed authentication. This email is in direct violation of CAN-SPAM Act (15 U.S. Code § 7704) and RFC 5321/5322 due to header forgery and misleading subject/content. This server’s host—M247 Ltd—has been notified before, but spam persists, suggesting host negligence and repeated abuse. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 148.72.153.88	08 Aug 2025	This unsolicited spam email was received on August 8, 2025, at 07:41:32 ET. The subject line falsely ... show more This unsolicited spam email was received on August 8, 2025, at 07:41:32 ET. The subject line falsely entices the recipient with misleading financial claims and HTML-based formatting resembling a casino promotion. The message originated from sending IP 148.72.153.88, hosted by GoDaddy.com LLC, and passed through multiple questionable sources, including 173.228.155.53 (sailthru.com). The sender forged the "From" field to display the recipient's name falsely, attempting to deceive the user. SPF passed, but DKIM failed with a permerror due to a missing public key. DMARC is not mentioned, which violates best practices. The email payload contains base64 and HTML with deceptive links, suggesting phishing behavior. This type of message violates CAN-SPAM and RFC 5322 standards on header integrity. Despite numerous spam reports, the host continues to ignore complaints and allows this abuse to persist. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 212.83.131.128	08 Aug 2025	This message is a classic example of fraudulent email spam using domain spoofing and email forgery. ... show more This message is a classic example of fraudulent email spam using domain spoofing and email forgery. The message falsely claims to originate from a popular shipping carrier and includes a malicious link disguised as a shipping label. The content attempts to socially engineer the recipient into clicking the link, which likely leads to malware or phishing. The "From" field deceptively uses the recipient’s name to mislead them into trusting the message. SPF authentication fails, DKIM is pass, and DMARC fails, confirming this was not authorized by the sending domain and is a spoof. The IP in question is listed in known blacklists and was flagged for suspicious behavior. This is part of a spam campaign targeting random recipients with deceptive shipping messages to lure clicks. The message poses a threat to users and systems. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.85	08 Aug 2025	Received August 8, 2025 at 03:49:05 PDT. Spam email used the recipient’s name in the "From" field to ... show more Received August 8, 2025 at 03:49:05 PDT. Spam email used the recipient’s name in the "From" field to impersonate a legitimate sender. Message claimed a false CashApp deposit of $8,500.00 and included deceptive links and obfuscated HTML to bypass filters. The email originated from IP 27.255.77.85, hosted on howell.aposternal.com, and relayed via mail server njmta-53.sailthru.com (173.228.155.53). SPF passed, but DKIM and DMARC results are missing, violating RFC 6376 and RFC 7489. This is a clear attempt to deceive users with phishing tactics and impersonation. Violates CAN-SPAM Act (false/misleading headers), and may breach wire fraud statutes by attempting to deceive for financial gain. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.59	08 Aug 2025	Email received on August 8, 2025 at 03:25:44 PDT. The message falsely used the recipient's name in t ... show more Email received on August 8, 2025 at 03:25:44 PDT. The message falsely used the recipient's name in the "From" field and claimed to include the recipient in a "Who's Who" registry. The message was spam-like, containing vague and suspicious promotional language with misleading calls to action and large blocks of encoded or meaningless text, all common hallmarks of deceptive marketing or phishing. The sending IP was 104.206.82.59 (associated with domain crona.yaroshones.com), and the email passed SPF but failed DKIM validation (permerror), and DMARC results were not present or not enforced, which violates email authentication standards (RFC 6376 & 7489). This lack of proper DKIM/DMARC checks increases phishing risks and enables header spoofing. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.86	08 Aug 2025	Spam email was received on Fri, 08 Aug 2025 06:01:23 -0400 and appeared to originate from IP 27.255. ... show more Spam email was received on Fri, 08 Aug 2025 06:01:23 -0400 and appeared to originate from IP 27.255.77.86, with mail server handoff by labicarious.net and intermediate routing via 173.228.155.53 (njmta-53.sailthru.com). The subject line misused the recipient’s name in a deceptive “Try a free assessment” marketing ploy, which is misleading and unsolicited. Message content promotes ED-related offers using deceptive language, violating CAN-SPAM Act requirements for truthful subject lines and consent. The sending domain passed SPF but did not include DKIM or DMARC results in the header, indicating insufficient email authentication. The spam appears to exploit compromised infrastructure or permissive mail servers to bypass filters and deliver mass mail. The inclusion of malformed message parts and obscure HTML payloads further suggests intent to obfuscate the message's true origin and evade detection, violating RFC 5321/5322. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇹🇷 193.8.113.231	08 Aug 2025	Spam received on Fri, 08 Aug 2025 02:59:26 -0700 from IP 193.8.113.231, relayed by mail server pdr8- ... show more Spam received on Fri, 08 Aug 2025 02:59:26 -0700 from IP 193.8.113.231, relayed by mail server pdr8-services-05v using Postfix. The email subject falsely claimed a €2,000 direct deposit and used obfuscated HTML and tracking links to deceive the recipient. The From field impersonated the recipient’s name, which is deceptive. SPF passed, but there are no DKIM or DMARC authentication results present, which violates standard RFC email authentication practices. This is a clear case of phishing and email spoofing, attempting to mislead users into clicking malicious financial bait. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.60	08 Aug 2025	Received on August 8, 2025, this message was a fraudulent spam email claiming the recipient had rece ... show more Received on August 8, 2025, this message was a fraudulent spam email claiming the recipient had received a $50,000 direct deposit. The email used elaborate HTML formatting and misleading branding to appear as a financial notification. The "From" field falsely used the recipient's name to disguise the sender’s identity and manipulate trust. The content included suspicious links designed to lure the recipient into clicking, suggesting phishing intent. The sending IP was 104.206.82.60, traced to daugherty.yaroshones.com. The email failed DKIM verification (permerror), and DMARC evaluation was bypassed (cv=none). Though SPF passed, that alone does not validate the source as legitimate. This violates CAN-SPAM Act provisions and RFC 5321/5322, especially in forging identity and deceptive header use. SpamCop reports bounce back as undeliverable. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇷🇴 89.41.182.193	08 Aug 2025	Received: Thu, 07 Aug 2025 at 22:11:24 PDT. The message originated from IP 89.41.182.193 (domain: bd ... show more Received: Thu, 07 Aug 2025 at 22:11:24 PDT. The message originated from IP 89.41.182.193 (domain: bdaymhjewerlyshop.com) and was relayed through mx.google.com. The sending server appears to be a compromised or malicious host distributing deceptive health-related spam. The “From” field falsely used the recipient's name to feign legitimacy. The email subject was “How 200 ml of This Yellow Vitamin Erased 10 Years of Sciatic Pain” and links to potentially dangerous or misleading websites under false medical pretenses. SPF: Pass DKIM: Not present DMARC: No policy found This message violates CAN-SPAM Act (false/misleading headers), RFC 5322 (malformed headers), and constitutes deceptive commercial content. Despite complaints, this host continues to relay spam without action. Hosting IP 89.41.182.193 is registered under M247 Europe SRL. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.40	07 Aug 2025	Email received August 7, 2025 at 12:04 PM PDT. This is a malicious spam email using deceptive HTML c ... show more Email received August 7, 2025 at 12:04 PM PDT. This is a malicious spam email using deceptive HTML content disguised as news, attempting to lure the recipient into clicking suspicious external links disguised as financial services. The "From" field falsely used the recipient’s name to increase trust, violating CAN-SPAM Act §7704(a)(1). The DKIM check failed, SPF passed, and DMARC alignment was not achieved. The mail originated from 162.211.120.40 hosted by Secure Internet LLC, a provider that continues to ignore abuse complaints and allows ongoing spam activity. Mail was relayed through multiple suspicious domains including .facebook.uybzwzwe.reachesbeast.com.de. Message also includes embedded base64 payloads and random encoded blobs indicative of obfuscation and phishing. Repeated abuse from this host has gone unresolved, suggesting negligence. RCF violation: RFC 5322 §3.6.2 (misleading header). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 50.2.188.219	07 Aug 2025	Spam received on Thu, 07 Aug 2025 09:38:10 PDT claiming the recipient is a "3rd winner" of a CVS Pha ... show more Spam received on Thu, 07 Aug 2025 09:38:10 PDT claiming the recipient is a "3rd winner" of a CVS Pharmacy gift card. Email content was deceptive, luring the recipient into clicking a malicious tracking link disguised as a reward confirmation. From field used recipient's name falsely, spoofing a fake domain: uvnuz7.0atxnf.0spnw0.us. SPF passed, but DKIM failed with permerror (no key for signature). DMARC results were not explicitly provided. SMTP relay originated from farrell.discussel.net (IP: 50.2.188.219). Despite ongoing reports, the hosting provider has ignored complaints and continues allowing this abuse. This violates CAN-SPAM Act (false header info, deceptive subject, unsolicited bulk email) and RFC 5322 standards (forged headers, misleading addresses). This activity persists unchecked, demonstrating negligence on the host’s part. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 5.135.60.124	07 Aug 2025	Email received on Thu, 07 Aug 2025 09:03:42 -0700. The message impersonated the recipient by using t ... show more Email received on Thu, 07 Aug 2025 09:03:42 -0700. The message impersonated the recipient by using their name in the From field to falsely suggest legitimacy. Content was deceptive and appeared as a fake payment confirmation with gibberish strings and suspicious links. The message included misleading HTML and marketing phrases with a fabricated receipt message, intending to deceive the user into clicking embedded links. DKIM failed with "permerror" (no key found), while SPF passed. DMARC alignment failed due to DKIM failure. This is part of a continuing pattern of abuse from this host, which has ignored prior spam complaints. Hosting provider is OVH SAS, AS16276. IP address 5.135.60.124. Company contact: OVHcloud, Phone: +33 9 72 10 10 07. This behavior likely violates the CAN-SPAM Act and RFC 5322 regarding email identity manipulation. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.51	07 Aug 2025	Received: Thu, 07 Aug 2025 08:57:31 -0700. This email used deceptive tactics to impersonate a known ... show more Received: Thu, 07 Aug 2025 08:57:31 -0700. This email used deceptive tactics to impersonate a known mobile payment app, falsely claiming the recipient had received a large cash deposit with no required action. The “From” field deceptively used the recipient's name as if it were the sender. The subject line and HTML body included phishing links designed to lure the user into clicking via urgent, misleading statements about receiving funds. DKIM authentication failed due to a permanent error—no valid key was found. SPF passed, but DMARC was missing or not properly enforced. The abuse persists despite complaints, suggesting the host is ignoring spam reports. This is a clear violation of the CAN-SPAM Act (15 U.S. Code § 7704), RFC 5322 (header spoofing), and potentially phishing laws under 18 U.S. Code § 1343. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.60	07 Aug 2025	This email was received on Thu, 07 Aug 2025 at 08:04:52 PDT. The message deceptively impersonates a ... show more This email was received on Thu, 07 Aug 2025 at 08:04:52 PDT. The message deceptively impersonates a legitimate pharmacy offering ED medication delivery, attempting to lure the recipient into clicking suspicious links. The "From" field falsely uses the recipient’s name to create the illusion of a trusted source. The content is heavily encoded, includes misleading subject lines, and lacks clear unsubscribe instructions. SPF passed, but DKIM failed due to a missing public key, and DMARC results are absent. This violates CAN-SPAM and FTC deception laws, and potentially breaches RFC 5322 (invalid headers) and RFC 7208 (SPF misuse). Email contact for Abuse: [email protected] or [email protected] show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.50	07 Aug 2025	On August 7, 2025 at 09:28 AM EDT, an unsolicited spam email was received promoting a suspicious “Wh ... show more On August 7, 2025 at 09:28 AM EDT, an unsolicited spam email was received promoting a suspicious “Who’s Who” registry inclusion. The message was crafted to appear professional, with false urgency and flattery to induce recipient engagement. The email contained dense, meaningless content blocks and links leading to potential phishing or data-harvesting sites. The "From" field was manipulated to display the recipient's name, a deceptive tactic. The DKIM check failed with permerror (no key for signature), while SPF passed, and DMARC failed to authenticate. Sending IP 162.211.120.50 is tied to domain 7yucca158.net, and the message was relayed through sailthru.com, indicating compromised or misused infrastructure. The host has ignored repeated complaints, and the spam persists. This violates the CAN-SPAM Act and RFC 5322 standards. The activity constitutes email spam, spoofing, phishing, exploited host, and web spam. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.50	07 Aug 2025	Email received on August 7, 2025 at 06:08:48 PDT. The message contained meaningless text strings and ... show more Email received on August 7, 2025 at 06:08:48 PDT. The message contained meaningless text strings and a fake “Top Stories of the Day” subject. The From field impersonated the recipient's name to create a false sense of trust. Message failed DKIM authentication due to a permanent error (no key for signature). DMARC status is absent, which violates standard email practices. SPF passed, but this alone is not sufficient for trust. The email appears to be a phishing or spam attempt using fake branding and gibberish content. This violates CAN-SPAM Act §7704(a), and may also violate RFC 5322 (improper message headers) and RFC 4871 (DKIM failure). This IP's host has been notified multiple times but continues to allow spam from their network, showing clear disregard for abuse complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 149.72.30.221	07 Aug 2025	Received on August 7, 2025 at 03:45 AM PDT. This unsolicited email advertised explicit adult product ... show more Received on August 7, 2025 at 03:45 AM PDT. This unsolicited email advertised explicit adult products using deceptive subject lines like “Your 1st order deserves something special!” The content contained numerous sexually explicit promotions and misleading sale claims. The sender forged the “From” field to falsely appear as the recipient’s name. Despite DMARC, DKIM, and SPF all passing, the email is still abusive, indicating the domain is being used deliberately for spam. Sending IP: 149.72.30.221. Mail server: o36.mailer.shopify.com. This email violates CAN-SPAM Act (15 U.S.C. § 7701) by sending sexually explicit marketing without affirmative consent and using misleading headers. It also breaches RFC 5322 due to deceptive display name practices. The host (Twilio SendGrid) has been repeatedly notified of this abuse and has failed to act, allowing spam to persist. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇰🇷 27.102.134.152	07 Aug 2025	Date/Time Received: Thu, 07 Aug 2025 03:23:17 -0700 Sending IP: 27.102.134.152 Mail Server IP: 27. ... show more Date/Time Received: Thu, 07 Aug 2025 03:23:17 -0700 Sending IP: 27.102.134.152 Mail Server IP: 27.102.134.152 This message fraudulently claimed a direct deposit of £2,000 had been made and used deceptive formatting to mimic a financial alert. The email body contained random alphanumeric strings and embedded images/HTML to evade filters. The "From" field deceptively used the recipient’s name as the sender. While SPF passed, no DKIM or DMARC validation was detected. This is a clear case of deceptive phishing and spam activity, violating CAN-SPAM Act and RFC 5322 (invalid "From" usage). Despite repeated reports, spam from this host continues unabated, suggesting the host ignores abuse complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 192.210.198.20	07 Aug 2025	Email received on August 7, 2025 at 02:41:42 PDT. Message claimed a £2,000 deposit was made, with em ... show more Email received on August 7, 2025 at 02:41:42 PDT. Message claimed a £2,000 deposit was made, with embedded links impersonating financial platforms. The From field deceptively used the recipient's name to falsely imply legitimacy. The sending IP was 192.210.198.20, and the email was relayed through klein.echoridgenovacraft.org.uk using Postfix. Header analysis shows SPF passed, but DKIM and DMARC validation headers are absent, suggesting poor authentication practices. Message contains phishing-style HTML claiming direct payment, attempting to lure victims into clicking external URLs under false financial pretense. This is a clear violation of CAN-SPAM Act (15 U.S. Code § 7701) and RFC 5322 (header forgery). Host of 192.210.198.20 is Psychz Networks (AS40676) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 74.112.66.52	07 Aug 2025	Received on August 6, 2025 at 15:36 PDT, this unsolicited commercial email falsely used the recipien ... show more Received on August 6, 2025 at 15:36 PDT, this unsolicited commercial email falsely used the recipient's name in the "From" field. The email promotes HVAC services and rebate offers via embedded tracking links, large HTML payloads, and deceptive branding. It contains excessive marketing content with embedded images and multiple outbound promotional URLs. The message originated from IP 74.112.66.52 (mail2152.digitalchoc.mkt2690.com), which passed SPF, DKIM, and DMARC checks, likely configured to appear legitimate. However, the message violates CAN-SPAM Act provisions by abusing mailing list mechanisms and deceptive header manipulation. There is no clear prior consent for this mailing, and the opt-out mechanisms are obscured within marketing content. This IP and its associated mail server continue to send bulk unsolicited emails despite ongoing complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.48	07 Aug 2025	Received on August 6, 2025, at 15:32 PDT. This deceptive spam email used false "from" field tactics ... show more Received on August 6, 2025, at 15:32 PDT. This deceptive spam email used false "from" field tactics by impersonating the recipient’s name to trick the recipient. The message subject falsely claimed urgent photo/video deletion and payment issues, using psychological manipulation to drive the user to click a phishing link. The email body contains randomized gibberish and heavily obfuscated HTML to evade filters. The mail originated from sending IP 162.211.120.48, tied to domain paypal.billing-login.info.coffensing.me. SPF passed, but DKIM failed with "permerror (no key for signature)," and DMARC results are missing, suggesting deliberate bypass of authentication protocols. The payload includes malicious unsubscribe links and masked redirects, likely harvesting login credentials or delivering malware. This violates CAN-SPAM Act, RCF 5322 (malformed headers), and RCF 7208/7489 (SPF/DMARC misuse). Repeated abuse from this IP shows the host is ignoring complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.49	07 Aug 2025	Received on August 6, 2025 at 17:33:07 ET. This message was a deceptive spam email pretending to off ... show more Received on August 6, 2025 at 17:33:07 ET. This message was a deceptive spam email pretending to offer a "$4,000 Welcome Bonus" and contained a payload of misleading financial content, likely part of a phishing scam. The email falsely used the recipient's name in the From field to trick the user into believing it was legitimate. The sending IP 162.211.120.49 (mail server bayer.7yucca158.net) passed SPF, but DKIM returned permerror due to a missing key, and DMARC was not aligned. This is a clear abuse of authentication mechanisms in violation of RFC 6376 and RFC 7489. Email included encoded text and obfuscated HTML links—standard techniques used in phishing and fraud attempts. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host