The sending IP appears as 40.93.1.45 with mail server infrastructure using outbound.protection.outlo ...
show moreThe sending IP appears as 40.93.1.45 with mail server infrastructure using outbound.protection.outlook.com. Although SPF, DKIM, and DMARC technically pass, this indicates abuse of a legitimate cloud email platform to distribute scam content rather than authentication failure. The email uses deceptive branding, false billing claims, and telephone-based fraud indicators consistent with phishing and impersonation. No legitimate prior transaction or consent exists for this communication.
This activity violates the CAN-SPAM Act (15 U.S.C. § 7701), FTC rules on deceptive practices, and RFC 5322 requirements regarding truthful message intent and headers. The behavior constitutes phishing and spoofing despite valid authentication. The IP space is owned by Microsoft Corporation. Abuse complaints can be directed to [email protected]show less
Received Mon, 9 Feb 2026 06:08:59 -0800 (PST). Source IP 208.117.56.135 sent as o8.ptr1822.fileforms ...
show moreReceived Mon, 9 Feb 2026 06:08:59 -0800 (PST). Source IP 208.117.56.135 sent as o8.ptr1822.fileforms.com / em6962.notifications.fileforms.com (SendGrid). Unsolicited compliance/marketing solicitation: claims a Florida Annual Report is still required, urges filing by May 1 to avoid a $400 late fee, and pushes links/buttons to file via FileForms. Sender branding could be mistaken as an official state notice even though it includes a third-party disclaimer. Auth: SPF PASS, DKIM PASS (notifications.fileforms.com & sendgrid.info), DMARC PASS.
show less
Received Sun, 08 Feb 2026 at 11:20:21 +0000. Unsolicited email titled “Dear Beloved….” claiming to b ...
show moreReceived Sun, 08 Feb 2026 at 11:20:21 +0000. Unsolicited email titled “Dear Beloved….” claiming to be from “Ms. Marisa Smith,” alleging terminal illness and requesting assistance to distribute USD 15,000,000 for charity while offering the recipient 40% as compensation. The message uses emotional manipulation, religious language, and urgency to solicit cooperation and a reply to a free webmail address. This is a classic advance-fee / inheritance scam.
Sending IP: 103.235.118.147 via mail server dealerfeeds.io, with authenticated submission originating from 185.169.4.16. SPF=none, DKIM=unknown, and DMARC=unknown/absent for the sending domain, indicating unauthenticated mail with no domain alignment. The Reply-To uses an unrelated free email account, strongly indicating forged sender identity. The message was delivered through compromised or misused infrastructure.
This activity violates the CAN-SPAM Act (15 U.S.C. §7701), FTC Act Section 5 regarding deceptive practices, and laws concerning wire fraud
show less
Received Sat, 07 Feb 2026 at 01:49:07 -0800. Unsolicited email titled “TESLA AWARD” claiming the rec ...
show moreReceived Sat, 07 Feb 2026 at 01:49:07 -0800. Unsolicited email titled “TESLA AWARD” claiming the recipient was randomly selected to receive Tesla stock worth over six million USD. The message impersonates “@Tesla Inc.” and instructs the recipient to contact a Gmail address posing as a claims department. This is a classic advance-fee / prize fraud using brand impersonation and false financial claims.
Sending IP: 84.2.38.67 via mail server anubis.silihost.hu, with prior relay from posta.silihost.hu (80.249.160.195). SPF=none and DMARC=fail (policy REJECT/QUARANTINE). DKIM is absent. The Reply-To uses an unrelated free email account, indicating forged sender identity. Spam filters flagged the message for advance-fee fraud, large monetary claims, forged Reply-To, and impersonation indicators.
This activity violates the CAN-SPAM Act (15 U.S.C. §7701), FTC Act Section 5 for deceptive practices, and statutes related to wire fraud and impersonation. It also violates RFC 5322
show less
Received Sat, 07 Feb 2026 15:31:04 -0800. Unsolicited business email titled “2026 Annual Report Fili ...
show moreReceived Sat, 07 Feb 2026 15:31:04 -0800. Unsolicited business email titled “2026 Annual Report Filing Notice for P13000000815” from “2026 Annual Report [email protected]
”. It urges filing a Florida annual report, warns of $500+ late fees, and pushes a paid “filing service,” while disclaiming it is not a government agency. If not requested, this is deceptive/unsolicited solicitation.
Sending IP: 192.174.88.80. Mail server: mta-174-88-80.sparkpostmail.com (SparkPost/Bird). SPF=pass and DKIM=pass; no SPF/DKIM failures shown. No DMARC result is present in this header. Likely bulk-mail delivery using harvested public business-contact information.
Potential violations: CAN-SPAM Act (15 U.S.C. §7701) for unsolicited commercial email and misleading urgency/claims; FTC Act Section 5 for deceptive practices. Possible RFC 5322/5321 misuse of header/subject to mislead.
show less
Received Fri, 6 Feb 2026 16:04:19 +0000. Message subject “Join us for an Open House!” sent as a prom ...
show moreReceived Fri, 6 Feb 2026 16:04:19 +0000. Message subject “Join us for an Open House!” sent as a promotional real-estate marketing email (image-based “OPEN HOUSE”), claiming to be from Shawn Knowles / Coldwell Banker Realty, with a physical mailing address shown in the body and one-click unsubscribe headers present. If you did not request these messages, this is unsolicited commercial email.
Sending IP: 54.240.62.51. Outbound mailhost shown as a62-51.smtp-out.us-west-2.amazonses.com (Amazon SES). SPF=pass, DKIM=pass (moxiimpress.sendproperty.com and amazonses.com), DMARC=pass (policy none). No SPF/DKIM/DMARC failures are indicated in the header, suggesting this was sent through an authorized bulk-mail system.
show less
Received Thu, 05 Feb 2026 15:33:51 -0800. Source IP: 20.51.178.41 (hostname make-20-51-178-41-rr1ums ...
show moreReceived Thu, 05 Feb 2026 15:33:51 -0800. Source IP: 20.51.178.41 (hostname make-20-51-178-41-rr1ums.eastus.cloudapp.azure.com / jaqartaa2.westbrookitpro.com). Provider appears to be Microsoft Azure; same IP used as sending mail server.
Message is unsolicited IPTV marketing (“TV made simple / Press Play”) with heavy sales copy, click-through CTA, and tracking-style links (Google Cloud Storage URL plus “unsubscribe”). Content is designed to drive clicks and potentially lead users into payment/credential capture flows.
Auth results: SPF=pass for westbrookitpro.com; DKIM not present in header; DMARC not shown/evaluated. From header uses a different random domain than the envelope sender (Return-Path), indicating deceptive sender identity. Likely violations: CAN-SPAM (misleading commercial email / insufficient sender transparency) and abusive use of SMTP/message headers contrary to RFC 5321/5322 norms. Abuse contact: [email protected].
show less
Received Thu, Feb 5, 2026 11:34:44 -0800 (PST). Email sent from 51.195.107.197 (HELO: RedheadSluts.c ...
show moreReceived Thu, Feb 5, 2026 11:34:44 -0800 (PST). Email sent from 51.195.107.197 (HELO: RedheadSluts.com / vps.ovh.net). Message impersonates a health insurer “UnitedHealthcare Rewards” and urges the recipient to “claim a free Oral-B Dental Kit” by clicking buttons that lead to a suspicious landing page (AWS S3 getinaccess.html) and a fake unsubscribe. Content includes malformed headers (Date field is not a real timestamp) and large amounts of injected/garbage text consistent with spam kit obfuscation. SPF: pass. DKIM: not present/none seen in header. DMARC: not present/none seen in header. Likely credential-harvest / redirect phishing + brand impersonation. Reported headers to OVH host via HTML Form submission.
show less
Spammer harvesting emails from Florida Sunbiz.
Received 2026-02-05 04:39:07 -0800. Unsolicited com ...
show moreSpammer harvesting emails from Florida Sunbiz.
Received 2026-02-05 04:39:07 -0800. Unsolicited commercial email themed as a “Florida Annual Report – 2026 Filing Reminder” for a named corporation. Message uses authoritative language (“required filing,” deadline emphasis) and prominent CTA buttons linking to third-party paid services (renewals.nationalfilingcorporation.com / e-filemycorp branding) while disclaiming government affiliation in fine print. This pattern is commonly used to pressure recipients into paying “convenience” fees for filings that can be completed directly with the state. Tracking parameters, branded SendGrid infrastructure, and reply-to pointing to a different entity indicate marketing solicitation rather than an official notice. Authentication shows SPF=pass, DKIM=pass (two DKIM signatures), DMARC=pass; no auth failure. Likely violates CAN-SPAM Act (15 U.S.C. §§7701–7713) provisions on deceptive subject/representation and unsolicited commercial email.
show less
Received Tue, 03 Feb 2026 12:00:03 +0000. Source: 54.240.9.12 (a9-12.smtp-out.amazonses.com / Amazon ...
show moreReceived Tue, 03 Feb 2026 12:00:03 +0000. Source: 54.240.9.12 (a9-12.smtp-out.amazonses.com / Amazon SES). Message claims “Social Security Administration” and urges “Download Now” to view a “statement/earnings and benefits,” linking to faxfalcon.com storage (z5aqvbivq.php?hightechoil.com) to lure credential/malware clicks.
Auth results: SPF=pass, DKIM=pass (apartamentehotel.ro and amazonses.com), DMARC=pass. Despite passes, this is classic brand-impersonation: display-name spoofing + government/benefits pretext + off-domain download link. Treat as phishing and unsolicited bulk email.
Likely violations: CAN-SPAM (materially misleading header/subject and deceptive routing), and potential wire-fraud attempt via phishing pretext. Network owner for 54.240.9.12 is Amazon Web Services; report to AWS Trust & Safety
show less
Received Tue, Feb 03 2026 03:39:25 -0800 (PST). Sending mail server/IP: a9-110.smtp-out.amazonses.co ...
show moreReceived Tue, Feb 03 2026 03:39:25 -0800 (PST). Sending mail server/IP: a9-110.smtp-out.amazonses.com (Amazon SES) [54.240.9.110]. Sender claimed: “Social Security Administration” <[email protected]> with subject “Your Statement: Ready for Download”.
Message content impersonates a government agency and urges the recipient to “download your statement,” embedding a credential/malware-style lure link to staging.caeta-dashb.com (z5aqvbivq.php with the recipient domain appended). This is consistent with phishing/social-engineering intended to drive clicks and steal data or deliver malware.
Auth results seen: SPF PASS, DKIM PASS (apartamentehotel.ro and amazonses.com), DMARC PASS (p=NONE). Despite passing auth, the content is deceptive and likely violates CAN-SPAM (15 USC 7704) regarding misleading header/subject and may implicate anti-fraud statutes if used to obtain money/data (e.g., 18 USC 1343). RFC concerns: misleading display-name/From identity (RFC 5322). Host/abuse contact: Amazon Web Services
show less
Received 2026-02-02 08:41:21 PST (Mon) / 16:41:18 UTC. Sending MTA IP: 40.93.20.68 (CH5PR02CU005.out ...
show moreReceived 2026-02-02 08:41:21 PST (Mon) / 16:41:18 UTC. Sending MTA IP: 40.93.20.68 (CH5PR02CU005.outbound.protection.outlook.com / outbound.protection.outlook.com). Message claims “Norton Auto-Renewal” charged $378.00 and urges calling (802) 225-2826, plus an “account email verification code” — classic tech-support/payment lure and brand impersonation.
Auth results in header: SPF=PASS, DKIM=PASS, DMARC=PASS for microsoftonline.com, so the abuse appears to come from (or route through) legitimately authenticated Microsoft mail infrastructure (likely compromised tenant/account or abused service), not simple SPF/DKIM spoofing.
Likely abuse categories: Email Spam, Phishing, Spoofing/Impersonation (and possibly Exploited Host if account compromise suspected). Potential legal issues include CAN-SPAM (15 USC 7704 deceptive routing/headers), FTC Act deception, and possible wire-fraud/impersonation statutes depending on intent. Abuse contact/host: Microsoft Corporation; report to [email protected].
show less
Received Wed, 04 Feb 2026 21:09:31 +0000. Unsolicited email claiming to be from an individual seekin ...
show moreReceived Wed, 04 Feb 2026 21:09:31 +0000. Unsolicited email claiming to be from an individual seeking assistance with vague “investment ventures” and requesting personal engagement. Message uses generic language, emotional appeal, and no verifiable business details, consistent with advance-fee or social-engineering scams.
Sending IP identified as 177.71.92.23 with upstream mail host srv01.juniornet.psi.br and client IP 190.242.98.162. Authentication results show SPF FAIL, DKIM UNKNOWN, and DMARC FAIL for the claimed hotmail.com sender, indicating spoofed sender identity and unauthenticated transmission.
Likely violations include the CAN-SPAM Act (deceptive unsolicited email) and attempted fraud/social engineering. RFC 5321/5322 abuse is evident through sender spoofing and authentication failures. IP ownership appears to be JuniorNet / PSI hosting. Abuse contact for the sending host: [email protected].
show less
Received Wed, 04 Feb 2026 00:48:49 +0000. Unsolicited “test email for validation” with no prior rela ...
show moreReceived Wed, 04 Feb 2026 00:48:49 +0000. Unsolicited “test email for validation” with no prior relationship, no functional purpose, and no opt-in evidence. Message claims to be a validation test and asks to be ignored, indicating mailbox probing or infrastructure testing rather than legitimate communication.
Sending IP identified as 198.91.86.10, injected via Yahoo infrastructure. Header shows SPF PASS, while DKIM and DMARC are reported as UNKNOWN for the sending domain, indicating incomplete or misconfigured authentication and lack of domain-level accountability.
Likely violations include the CAN-SPAM Act (unsolicited email without consent) and abuse of SMTP for non-transactional test traffic. No clear RFC 5321/5322 header formatting violations detected, but behavior constitutes spam and potential reconnaissance activity. IP owner appears to be Leafdenary hosting. Abuse contact for the sending host: [email protected] and [email protected]show less
Received 2026-02-03 06:48:25 -0800. Suspected phishing/spam: subject 'Check Request' with branded HT ...
show moreReceived 2026-02-03 06:48:25 -0800. Suspected phishing/spam: subject 'Check Request' with branded HTML 'Harry&David Service/Exclusive Offer' and multiple calls-to-action linking to an Azure blob URL (knjgds.blob.core.windows.net) plus embedded image (bobo.png). Content uses urgency/referrals and invites clicks; includes unrelated pasted text (course syllabus) consistent with padding/obfuscation. Source shows submission from 45.151.155.54 (steelhaven.com) into Gmail; likely compromised host/VPS. Auth: SPF=pass; DKIM=pass; DMARC=pass (no auth failure). Header has invalid Date (year 9635) and misleading fields, conflicting with RFC 5322 formatting/accuracy. Likely violates CAN-SPAM Act (15 USC 7701-7713) deceptive header rules. Network Kamatera, Inc. (AS36007). Abuse: [email protected]show less
Received Tue, 03 Feb 2026 05:21:33 -0800. Message claims an urgent “Stripe invoice” and asks for an ...
show moreReceived Tue, 03 Feb 2026 05:21:33 -0800. Message claims an urgent “Stripe invoice” and asks for an invoice image, using a long/odd subject line and high priority flags; includes a suspicious BMP attachment. This is unsolicited and consistent with phishing/malware delivery via attachment.
Header shows originating client IP 43.131.53.162 (ESMTPSA into Gmail) and Gmail relay mail-sor-f41.google.com / 209.85.220.41. Authentication checks: SPF PASS, DKIM PASS, DMARC PASS for the sending gmail.com account (no SPF/DKIM/DMARC failures observed).
Likely violations: CAN-SPAM Act (deceptive commercial email practices) and attempted fraud/social engineering; no clear SMTP/RFC header forgery is evident because the message authenticates. IP ownership/abuse contacts: 43.131.53.162 appears on Tencent (AS132203) [email protected]; Google relay 209.85.220.41 [email protected].
show less
Fraudulent email sent with phishing links.
Received 2026-02-03 02:19:45 -0800 (PST) / 10:19:45 UT ...
show moreFraudulent email sent with phishing links.
Received 2026-02-03 02:19:45 -0800 (PST) / 10:19:45 UTC. Source IP: 167.89.80.92 (hostname o1290.shared.klaviyomail.com). Message routed via SendGrid/Klaviyo infrastructure; Message-ID JSHEWmQrRRWfiivoCH081A@geopod-ismtpd-32.
Auth results: SPF=PASS, DKIM=PASS (dreamhost.com and sendgrid.info), DMARC=PASS (policy p=none). From: “DreamHost <[email protected]>”. Subject: “PHP Extended Support has been removed.” Body says a scan found your sites upgraded to supported PHP versions and that “PHP Extended Support” was removed; invites you to contact support; includes one-click list unsubscribe headers.
If unsolicited, this may violate the U.S. CAN-SPAM Act (unsolicited commercial email / consent issues). No obvious RFC 5321/5322 header-format violations are apparent from the trace. IP owner/ESP abuse contacts: [email protected] and [email protected].
show less
Received 2026-02-02 15:21:57 UTC. Source 128.245.182.232 (ali232.mta.exacttarget.com) sent an unsoli ...
show moreReceived 2026-02-02 15:21:57 UTC. Source 128.245.182.232 (ali232.mta.exacttarget.com) sent an unsolicited marketing message titled “Bootcamp for New Managers and Supervisors: Develop These Essential”. Message includes bulk-email headers (List-Unsubscribe/one-click) and reply routing via resource.onlinetranings.com. Auth checks: SPF=PASS, DKIM=PASS (2 signatures: campaign.onlinlearnings.com and s12.y.mc.salesforce.com), DMARC=PASS, compauth=PASS. Not a user-originated message; appears to be mass-mail advertising/training promo. Possible CAN-SPAM concerns if no prior consent or if opt-out not honored; request investigation and suppression. Abuse contact: ExactTarget/Salesforce Marketing Cloud [email protected]show less
Received Sun, 01 Feb 2026 14:56:41 +0000. Unsolicited bulk email labeled “Reminder: Event Tomorrow” ...
show moreReceived Sun, 01 Feb 2026 14:56:41 +0000. Unsolicited bulk email labeled “Reminder: Event Tomorrow” sent without prior relationship or consent. Message contains minimal visible content, hidden HTML elements, and bulk-mail indicators, consistent with deceptive or low-content spam delivery rather than a legitimate transactional notice.
Header analysis shows originating IP 77.36.28.68 using mx1.astrophysicshub.com as the sending mail server. SPF=pass, DKIM=unknown, DMARC=pass. Despite authentication passing, the message was sent as bulk mail with concealed content and no clear opt-in, indicating abuse of a valid domain and infrastructure rather than authentication failure.
This activity violates the CAN-SPAM Act (15 U.S.C. §7701–7713) due to unsolicited bulk transmission and deceptive content practices. It also conflicts with RFC 5322 transparency requirements and RFC 7489 intent regarding responsible domain use. The apparent sending host is astrophysicshub.com. Abuse contact: [email protected]show less
Received Sun, 01 Feb 2026 11:26:48 +0000. Unsolicited financial fraud email claiming to be from a go ...
show moreReceived Sun, 01 Feb 2026 11:26:48 +0000. Unsolicited financial fraud email claiming to be from a government ministry and requesting assistance transferring USD $35,500,000 derived from an inflated contract. Message solicits foreign bank account details, promises a percentage payout, demands secrecy, and asserts the transaction is “risk free,” which is a classic advance-fee / corruption scam.
Header analysis shows originating IP 103.170.5.29 relayed via huiyixx.cn, with upstream submission from 185.22.65.20. SPF=fail, DKIM=unknown, DMARC=fail. The From address uses a domain not authorized to send mail from the originating IP, and Reply-To points to a different mailbox, indicating spoofing and deliberate misrepresentation.
This activity violates the CAN-SPAM Act (15 U.S.C. §7701–7713) due to deceptive content and false header identity, and constitutes wire-fraud solicitation. It also violates RFC 5322 (misleading From/Reply-To fields) and RFC 7208 authentication best practices.
show less
Received Sat, 31 Jan 2026 06:50:42 +0000. Unsolicited advance-fee scam email claiming religious char ...
show moreReceived Sat, 31 Jan 2026 06:50:42 +0000. Unsolicited advance-fee scam email claiming religious charity intent and requesting assistance distributing a supposed USD $15,000,000 deposit. Message uses emotional manipulation, terminal illness narrative, and promises a 40% personal reward to induce response. This is a classic financial fraud / social-engineering scheme.
Header analysis: originating IP 103.235.118.147 relayed via dealerfeeds.io; upstream authenticated submission from 185.169.4.18. SPF=none, DKIM=unknown, DMARC=unknown. The From address uses a generic domain with no authorization, indicating spoofed or unauthenticated sender identity. Reply-To redirects to a different mailbox, further indicating fraud.
This activity violates anti-fraud and anti-spam laws including CAN-SPAM Act (15 U.S.C. §7701–7713) for deceptive messaging, false header identity, and lack of consent. It also violates RFC 5322 (misleading From/Reply-To fields) and RFC 7208 best practices by failing sender authentication.
show less
Received Sat, 31 Jan 2026 00:26:49 -0800 (PST). IPs in header: 179.43.151.64 (injected to api.elasti ...
show moreReceived Sat, 31 Jan 2026 00:26:49 -0800 (PST). IPs in header: 179.43.151.64 (injected to api.elasticemail.com) and outbound MTA 69.72.31.173 (w173.mxout.mta1.net / Elastic Email). Subject: “RILEY RESEARCH CORPORATION - 2026 Annual Report Filing Notice for P13000000815”. SPF=pass, DKIM=pass, DMARC=pass.
Unsolicited “annual report” filing reminder pushing a paid filing service, urging quick action to avoid late fees, with tracking/checkout links; states it is not affiliated with any government agency while using official-sounding branding. Includes unsubscribe.
Likely email spam / deceptive solicitation. May implicate CAN-SPAM (misleading solicitation/header claims) and conflicts with RFC 5322/5321 bulk-mail best practices if sent without consent.
show less
Fraud OrdersPhishingWeb SpamEmail SpamSpoofing
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.