synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇸 162.211.120.50	07 Aug 2025	Received on August 6, 2025 at 1:36 PM PDT. This spam email used deceptive headers claiming to be a “ ... show more Received on August 6, 2025 at 1:36 PM PDT. This spam email used deceptive headers claiming to be a “Water Contamination Lawsuit” offer. The content was misleading, promotional, and used clickbait text suggesting recipients could receive free legal claims related to military base exposure. The sender impersonated a legal entity but routed through suspicious domains. The from field falsely used the recipient’s name to increase trust. DKIM failed (permerror: no key for signature), SPF passed, and DMARC result is absent, which violates RFC 7489. This violates CAN-SPAM (15 U.S.C. §§7701–7713), especially using deceptive headers and failing to identify itself as an ad. Sending IP: 162.211.120.50. Mail server also connected via 173.228.155.53. Host of 162.211.120.50 is Interserver, Inc. Despite previous reports, this provider continues to ignore abuse complaints, and spam keeps arriving from their network. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 51.79.61.147	06 Aug 2025	Email received on Wed, 06 Aug 2025 12:28:30 -0700 was unsolicited and fraudulent in nature. The mess ... show more Email received on Wed, 06 Aug 2025 12:28:30 -0700 was unsolicited and fraudulent in nature. The message falsely promised a $8,613.94 casino jackpot payout with an urgent call-to-action to claim before midnight. The spam used misleading jackpot language and embedded links attempting to redirect to external sites. The sender forged the recipient’s name in the "From" field, a deceptive spoofing tactic. DKIM failed with "permerror" due to a missing or misconfigured signature, and SPF passed, allowing the spoof to slip through. This violates CAN-SPAM Act (15 U.S.C. §§ 7701-7713), including misleading header info and deceptive subject lines. RFC violations include RFC 5321 and 5322 for header spoofing. The IP owner has been repeatedly notified, yet spam continues, showing disregard for abuse complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Web App Attack
🇨🇦 51.79.61.148	06 Aug 2025	Received spam email on August 6, 2025 at 14:26:08 ‑0400. The “From” field falsely used the recipient ... show more Received spam email on August 6, 2025 at 14:26:08 ‑0400. The “From” field falsely used the recipient’s own name to create a misleading sender identity. SPF passed, DKIM failed (no key), DMARC not enforced or failed. The message contained promotional content urging a “free assessment,” with suspicious origin domain abusing governmental naming conventions and continuing despite prior complaints. The hosting server shows no action taken to prevent persistent spam. Likely indicators of Email Spam and possibly Spoofing. The campaign disregards email authentication standards and continues despite reports, suggesting negligence by the hosting provider. Please investigate hosting abuse contact for IP 51.79.61.148. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.61	06 Aug 2025	On Aug 6, 2025 at 12:59 PM EDT, this IP sent deceptive spam promoting a false claim about an "electr ... show more On Aug 6, 2025 at 12:59 PM EDT, this IP sent deceptive spam promoting a false claim about an "electricity saving invention" attributed to Elon Musk, urging users to click malicious links. The email header reveals that the "From" field used the recipient's name falsely. The message was disguised as a news article but was riddled with random characters and cloaked with a misleading subject line. SPF passed, DKIM failed with permerror (no key for signature), and DMARC failed due to invalid alignment. This violates CAN-SPAM Act, CFAA (Computer Fraud and Abuse Act), and RFC 5322 (invalid headers). The IP’s mail host continues to ignore prior spam complaints and has taken no action to curb abuse. This pattern of behavior demonstrates willful negligence by the hosting provider. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 51.83.49.240	06 Aug 2025	Email received on Wed, 06 Aug 2025 at 09:07:28 PDT. This is a deceptive phishing email disguised as ... show more Email received on Wed, 06 Aug 2025 at 09:07:28 PDT. This is a deceptive phishing email disguised as an alert regarding "Check your Account-ID" with a fake unsubscribe message and embedded base64 obfuscation. The content impersonates a financial or tech service to trick recipients into clicking malicious links. The from field used the recipient's name as a false sender identity. DKIM failed with "permerror (no key for signature)". SPF passed. DMARC results not shown. This violates multiple RFC standards including RFC 5322 (header spoofing) and may constitute wire fraud and electronic impersonation under U.S. laws. The host continues to ignore complaints, allowing repeat abuse. Spam persists. This is deliberate, malicious spam from a server hosted at OVH SAS (AS16276). Host: OVHcloud, phone: +1 855-684-5463. We all need to get lawyers and go after these unaccountable hosting companies. Spam complaints do absolutely NOTHING! show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.59	06 Aug 2025	Spam email received on August 6, 2025 at 8:57 AM PDT. The message impersonated the recipient by usin ... show more Spam email received on August 6, 2025 at 8:57 AM PDT. The message impersonated the recipient by using their name in the "From" field, a common phishing tactic. The subject line falsely urges account verification and claims to offer mobile casino bonuses and payout confirmations. The HTML body contained deceptive formatting and embedded links to suspicious URLs, consistent with phishing campaigns. The email originated from IP 104.206.82.59 (hosted on crona.yaroshones.com) and passed SPF, but DKIM failed with a permanent error and DMARC had no result. Sending domain is spoofed and lacks valid DKIM records. The spam content uses obfuscation, misleading financial offers, and unsubscribe bait. The host of this IP (Interserver, Inc. \| ☎ 1-877-566-8398) continues to ignore abuse complaints as similar spam from this network persists. This violates CAN-SPAM Act and RFC 5322/7208. Reported to hosting provider. Spam reports sent to [email protected] go completely ignored. We all need to take legal action now. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 104.206.82.61	06 Aug 2025	This email is an elaborate phishing spam, deceptively using the recipient’s name in the “From” field ... show more This email is an elaborate phishing spam, deceptively using the recipient’s name in the “From” field to appear legitimate. It falsely claims the recipient is a “3rd Winner” of a CVS Pharmacy prize and contains both HTML and plaintext parts urging the user to click external links masked as reward confirmation. The body is littered with encoded text and obfuscated redirects to bypass spam filters. ❗ SPF: Pass ❗ DKIM: Permanent Error (no key for signature) ❗ DMARC: Failed due to DKIM issues 📛 RFC Violations: Invalid DKIM, forged sender identity, misleading subject headers Despite repeated abuse reports, spam continues unabated. Host shows no intent to stop the abuse. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 76.223.142.8	06 Aug 2025	Received on August 6, 2025 at 06:45 AM PDT. This unsolicited email used deceptive marketing tactics ... show more Received on August 6, 2025 at 06:45 AM PDT. This unsolicited email used deceptive marketing tactics promoting an unlisted company offering investment opportunities, claiming rapid growth and IPO access. The body contained aggressive hype, repeated external links, misleading headlines, and dubious income promises. The email impersonated the recipient’s name in the “From” field, a tactic meant to deceive recipients. SPF and DKIM checks passed, but DMARC failed for domain marketmysterycode.com. Despite opt-out links, continued spam persists, indicating disregard for CAN-SPAM compliance. Host is Amazon.com, Inc., IP: 76.223.142.8, phone: +1-206-266-4064. This host continues to allow abuse despite repeated complaints. Violates CAN-SPAM Act (15 U.S. Code § 7701), FTC deceptive marketing rules, and RFC 5322 for header authenticity. Report forwarded to hosting abuse team. NEVER SIGNED UP to receive anything from these people. Have no idea who they are. TOTAL UNSOLICITED SPAM. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇹🇷 89.43.31.185	06 Aug 2025	Received on August 6, 2025 at 03:42:48 PDT. This email used deceptive subject text ("𝗬𝗢𝗨.𝗛𝗔𝗩𝗘.𝗕𝗘𝗘𝗡.𝗣 ... show more Received on August 6, 2025 at 03:42:48 PDT. This email used deceptive subject text ("𝗬𝗢𝗨.𝗛𝗔𝗩𝗘.𝗕𝗘𝗘𝗡.𝗣𝗔𝗜𝗗") and impersonated the recipient's name in the "From" field, attempting to lure the user into clicking suspicious links promising €2000. The HTML payload was heavily obfuscated and linked to what appears to be a credential harvesting site hosted on Google's storage platform. The sender IP was 89.43.31.185 (lesch.takened.net) and mail server was also from this same IP. This violates CAN-SPAM Act (15 U.S.C. §7701), and may violate RCF 5322 due to header forgery. Although SPF passed, DKIM and DMARC were not present, allowing spoofing. This header has been reported to the IP's host, SC CLAX TELECOM SRL, who has ignored past abuse complaints and continues to allow spam to originate from this address. Spamcop email complaint sent to [email protected] show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇷🇴 89.38.104.153	06 Aug 2025	This spam email was received on Wednesday, August 6, 2025 at 05:57:55 -0400. The message claimed the ... show more This spam email was received on Wednesday, August 6, 2025 at 05:57:55 -0400. The message claimed the recipient had received a €2000 deposit and used emotionally manipulative formatting, emojis, and fake payment notices to lure the user into clicking phishing links. The email contained fake confirmation and unsubscribe links that redirected to deceptive domains using obfuscated and misleading subdomains. The sending IP was 89.38.104.153, and the mail server also appears to be from that IP (sledes.entertainavoid.com). The From field impersonated the recipient's name, likely to deceive the recipient into believing it was a legitimate message. The Return-Path address used a suspicious government-like subdomain: mary2-jamison2.sealed-email.certified-mail.auth.gov.us.unionisted.com. This is an obvious spoof attempting to bypass filters by mimicking government domains. SPF passed, but no DKIM or DMARC authentication was observed. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇷🇴 89.41.182.193	06 Aug 2025	Email received on August 5, 2025, at 5:13 PM PDT promotes a misleading CarShield “free quote” offer. ... show more Email received on August 5, 2025, at 5:13 PM PDT promotes a misleading CarShield “free quote” offer. The email appears to impersonate the recipient by using their name in the "From" field, which violates ethical mailing practices. The body includes heavy marketing language about vehicle warranties, prompting the user to click tracking links. This unsolicited commercial content was not requested and violates CAN-SPAM Act provisions due to lack of valid consent and deceptive content. The email was sent from IP 89.41.182.193 via host bartell.bdaymhjewerlyshop.com, which relayed through Sailthru (173.228.155.53). The SPF record passed, but there was no DKIM or DMARC result shown, indicating potentially forged headers or missing authentication. This is a textbook case of abuse of SMTP infrastructure for commercial spam, a clear violation of RFC 5321 and 5322. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 163.172.221.172	06 Aug 2025	Email received on Tue, 05 Aug 2025 at 14:25:29 PDT. Message pretended to be a security alert and use ... show more Email received on Tue, 05 Aug 2025 at 14:25:29 PDT. Message pretended to be a security alert and used emotionally manipulative language with odd Unicode characters and fake urgency about account access. The message included random gibberish in both text/plain and text/html parts and presented fraudulent links disguised as Google Storage URLs. This is a clear attempt to phish or confuse recipients. The sending IP was 163.172.221.172 (hostname: syn-163-172-221-172.wifi.spectrum.com) and passed SPF despite being part of an apparent spam infrastructure. DKIM and DMARC results were not provided or verified in the headers. The "From" field deceptively used the recipient’s name to appear legitimate, violating RFC 5322 regarding proper email formatting. Spam continues from this host despite repeated abuse reports, indicating the hosting provider (likely Online SAS / Scaleway) is ignoring complaints. This violates CAN-SPAM, GDPR, and potentially wire fraud statutes. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.40	06 Aug 2025	This spam email was received on Tue, 05 Aug 2025 at 16:58:50 -0400. It falsely claims a cash prize a ... show more This spam email was received on Tue, 05 Aug 2025 at 16:58:50 -0400. It falsely claims a cash prize and uses manipulative urgency ("Confirm It Before 11:59 PM") to lure the recipient into clicking suspicious links. The email body is a mix of misleading HTML marketing content and encoded characters designed to evade filters. The “From” field impersonates the recipient’s name, violating ethical norms and likely intending to deceive the recipient. SPF passed, but DKIM returned a permanent error (no key for signature), and DMARC alignment failed. The email was routed via Sailthru infrastructure (IP 173.228.155.53), suggesting use of a third-party mass-mailer or open relay. Message-ID and return-path domains do not align with legitimate sources. This spam violates multiple standards, including CAN-SPAM Act requirements (false header info, deceptive content) and RFC 5321 (improper MAIL FROM behavior). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 162.211.120.41	05 Aug 2025	Spam email received on August 5, 2025 at 13:36 PDT. Message pretended to be a trusted sender but use ... show more Spam email received on August 5, 2025 at 13:36 PDT. Message pretended to be a trusted sender but used a fake display name matching the recipient's name in the “From” field. The subject was “𝗣𝗹𝗲𝗮𝘀𝗲 𝗖𝗵𝗲𝗰𝗸 𝗬𝗼𝘂𝗿 𝗔𝗰𝗰𝗼𝘂𝗻𝘁,” a phishing attempt disguised as account verification or news. The email contained nonsensical text, hidden links, and suspicious branding. SPF passed, but DKIM failed, and DMARC was not aligned. Message originated from 162.211.120.41, hosted on willica.net. Header shows injection via sailthru.com, commonly abused. This violates CAN-SPAM Act and RFC 5321 (forged sender), RFC 5322 (invalid formatting), and attempts phishing and fraud. Company / Network Owner: PrivateSystems Networks (operating the 162.211.84.0 /22 Abuse Contact Email: [email protected] Abuse Contact Phone: +1‑866‑332‑9894 show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.83	05 Aug 2025	Email received on Tue, 05 Aug 2025 16:30:52 -0400 promotes a deceptive product under the subject lin ... show more Email received on Tue, 05 Aug 2025 16:30:52 -0400 promotes a deceptive product under the subject line "This powerful tea is changing men’s lives." The message contains nonsensical text, obscured tracking links, and misleading claims about a tea’s health benefits, resembling affiliate spam and potential health fraud. The "From" field falsely uses the recipient's name, a clear spoofing tactic. SPF passed, but no DKIM or DMARC headers were found, indicating a failure to properly authenticate the message. Source IP is 27.255.77.83 (aposternal.com), linked to repeated spam. Despite previous reports, the host has taken no action, allowing this activity to continue unchecked. This violates CAN-SPAM (15 U.S. Code § 7704), misuses "multipart/report" content-type, and may breach RFC 5322. Host appears to be HKBN Enterprise Solutions HK Limited. Their listed number is +852 3999 2500. Host demonstrates disregard for abuse complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 163.172.221.172	05 Aug 2025	Just reported this IP here and SpamCop an hour ago and they are back at it. This email was received ... show more Just reported this IP here and SpamCop an hour ago and they are back at it. This email was received on August 5, 2025, at 14:23 EDT and appears to be part of a spam or phishing campaign. The message originates from IP address 85.209.57.168 (seen in the Received header). The email contains a fake order confirmation for “Invoice Number #81130706,” attempting to mislead the recipient into opening a PDF attachment named “Confirmation_order#81130706.pdf,” likely containing malicious content. The sender used the recipient's name in the "From" field to falsely impersonate a trusted contact. Authentication checks failed: SPF failed (spf=fail), DKIM failed (dkim=fail), and DMARC failed (dmarc=fail). These failures strongly suggest the email is spoofed. The use of invoice bait and impersonation tactics indicate an intent to deceive and possibly deploy malware or steal information. This IP should be investigated for abusive behavior. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 163.172.221.172	05 Aug 2025	14 hours later they are at it again. I keep reporting it via SpamCop but they ignore the complaints ... show more 14 hours later they are at it again. I keep reporting it via SpamCop but they ignore the complaints. his spam email was received on Tue, 05 Aug 2025 12:05:28 -0700. The message falsely used the recipient’s name in the “From” field to mislead. The subject promoted pills claiming to cure erectile dysfunction and included deceptive marketing links masked with medical claims and images. SPF passed, but no DKIM or DMARC authentication is present, a violation of best email practices under RFC 6376 and RFC 7489. This message violates the CAN-SPAM Act by sending unsolicited adult-themed content, misrepresentation, and lack of clear opt-out mechanisms. The sending IP is 163.172.221.172, hosted by Scaleway S.A.S., which has been repeatedly notified, but they continue to ignore abuse complaints, allowing the spam to persist unabated. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇸🇬 45.125.194.164	05 Aug 2025	This unsolicited bulk email was received on Tue, 05 Aug 2025 at 11:11 AM PDT. The message promotes a ... show more This unsolicited bulk email was received on Tue, 05 Aug 2025 at 11:11 AM PDT. The message promotes a fraudulent casino site with a deceptive subject line "Check your mail - your money 💰💲 is waiting!" and includes links redirecting to external Google Cloud-hosted phishing pages. The "From" field used the recipient’s name falsely to appear legitimate. SPF passed, but DKIM failed due to missing key (permerror), and DMARC was not aligned. Content is rich in deceptive offers such as "$2000 payout" and "135 Free Spins," urging the user to click on malicious links under the pretense of final account confirmation. This violates the CAN-SPAM Act and potentially RCF 5322 for misleading headers. Despite prior reports, spam from this sender persists, indicating the host ignores abuse complaints. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.102.127.149	05 Aug 2025	On August 5, 2025, at 10:52 AM PDT, an unsolicited commercial email promoting a casino offer with fa ... show more On August 5, 2025, at 10:52 AM PDT, an unsolicited commercial email promoting a casino offer with false payout claims and deceptive HTML formatting was received. The email used the recipient's name in the "From" field falsely. The message advertised a "$2,000 payout" and "135 free spins" and attempted to lure the user into clicking links hosted on Google Cloud Storage, likely leading to malicious or phishing content. The email header shows SPF passed, DKIM failed (permerror), and DMARC validation not explicitly stated—indicating the message failed key authentication checks. This is a clear violation of CAN-SPAM Act and RFC 5322, including falsified sender identity and unsolicited mass mailing. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇦 198.27.115.99	05 Aug 2025	This email was received on Tue, 05 Aug 2025 13:42:09 -0400 and is a fraudulent phishing attempt usin ... show more This email was received on Tue, 05 Aug 2025 13:42:09 -0400 and is a fraudulent phishing attempt using urgent scare tactics stating "Your photos and videos will be deleted" to lure the recipient into clicking malicious links. The content impersonates billing alerts and mimics a cloud storage provider. The "From" field used the recipient's name deceptively, a clear indicator of spoofing. SPF passed, but DKIM failed with "permerror (no key for signature)", and there is no DMARC result, violating email authentication standards (RFC 6376 & 7489). The email was relayed via 198.27.115.99 (OVH Hosting), which continues to allow spam through their infrastructure despite ongoing reports. This violates the CAN-SPAM Act (15 U.S.C. § 7704) by sending deceptive headers and misleading subject lines. Host appears unresponsive to abuse complaints and enables continued malicious activity. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 144.91.120.80	05 Aug 2025	Received: Tue, 05 Aug 2025 10:34:31 -0700. This email is a blatant phishing spam promoting a fake on ... show more Received: Tue, 05 Aug 2025 10:34:31 -0700. This email is a blatant phishing spam promoting a fake online casino with a fabricated €4,500 bonus and 350 free spins. The subject line misuses the recipient's name to create a false sense of legitimacy. The content is deceptive, containing both plaintext and HTML payloads, heavily obfuscated, and laden with suspicious links designed to lure recipients into disclosing personal or financial information. The sending IP is 144.91.120.80. Although SPF passed, DKIM and DMARC results are absent or failed, indicating unauthenticated origin. From field used recipient's name as a false display. This violates CAN-SPAM Act and RFC 5321/5322 standards due to misleading header information and deceptive content. The hosting provider continues to allow abuse despite repeated spam activity. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇿 85.117.243.241	05 Aug 2025	Unsolicited email received Tue, 05 Aug 2025 13:33:47 -0400 advertising a fraudulent 500% bonus. The ... show more Unsolicited email received Tue, 05 Aug 2025 13:33:47 -0400 advertising a fraudulent 500% bonus. The message is deceptive and encoded in both plain text and HTML, pushing the user to click to "confirm" a bonus. The “From” field falsely used the recipient's name, attempting to trick the user into trusting the sender. DKIM failed with a permerror due to no key for the signature. SPF passed. No DMARC result listed. Message originated from IP 85.117.243.241. The spammer forged federal domains in the Return-Path (autonomous-vehicles.guidance.dot.gov.gigandard.com), likely violating CAN-SPAM, fraud, wire fraud, and RFC 5322 (header field misuse). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 66.181.34.53	05 Aug 2025	This email was a deceptive phishing spam disguised as a "cloud storage alert," attempting to trick t ... show more This email was a deceptive phishing spam disguised as a "cloud storage alert," attempting to trick the recipient into clicking misleading links by falsely claiming the user's storage was full. The message was HTML-heavy, loaded with false urgency, embedded tracking links, and misleading unsubscribe buttons. The From field deceptively used the recipient's name to falsely appear legitimate. The domain used in the return-path was “kestely.uk.com”, with SPF passing but DKIM showing permerror and DMARC failing due to a missing or invalid key. This message grossly violates [RFC 5322] standards for email formatting and authentication and is part of an ongoing campaign ignored by the host. This IP and infrastructure are being knowingly abused. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇸🇬 45.125.194.166	05 Aug 2025	Spam email received on Tue, 05 Aug 2025 at 09:45:27 -0700 contained deceptive claims about a $13,963 ... show more Spam email received on Tue, 05 Aug 2025 at 09:45:27 -0700 contained deceptive claims about a $13,963.99 direct deposit with “no deposit required.” This is a clear attempt to lure recipients into a fraudulent offer. The email used the recipient’s name as the "From" field falsely, misleading the reader. The sending server at 45.125.194.166 passed SPF but failed DKIM with permerror and lacked DMARC authentication, violating RFC 6376 and RFC 7489 standards. This email was routed through a suspicious domain plantializing.us.com and included obscured phishing links and obfuscated HTML code to bypass spam filters. The host of this IP, HK Dong Tai Internet Services Limited, appears to ignore abuse complaints as spam from this source continues. Abuse of this nature may violate U.S. CAN-SPAM Act and international email fraud laws. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇩🇪 161.97.105.30	05 Aug 2025	Received on Tue, 05 Aug 2025 at 09:33:10 PDT. This email impersonated Gmail Support and used the rec ... show more Received on Tue, 05 Aug 2025 at 09:33:10 PDT. This email impersonated Gmail Support and used the recipient's name in the “From” field to falsely appear legitimate. The subject falsely claimed account termination warning and contained deceptive unsubscribe links and phishing buttons urging credential input. DKIM failed (permerror) and DMARC evaluation failed due to missing key. SPF passed but is irrelevant as domain was forged. The payload included malicious HTML and fake account warnings designed to harvest user credentials. This violates CAN-SPAM, the U.S. Computer Fraud and Abuse Act (18 U.S.C. § 1030), and RFC5322 (section 3.6.2). Host Contabo GmbH (AS51167) owns 161.97.105.30 and has repeatedly ignored spam complaints. Contact: [email protected], +49 89 356471770. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host