Received Thu, 29 Jan 2026 13:51:21 -0800. Unsolicited bulk email advertising EN590 10PPM diesel, Vir ...
show moreReceived Thu, 29 Jan 2026 13:51:21 -0800. Unsolicited bulk email advertising EN590 10PPM diesel, Virgin D6 fuel oil, and Jet Fuel A1 and requesting a “company profile”/buying requirements; Reply-To points to [email protected] (different from From domain), suggesting B2B scam/spam.Sending host/mail server: 2.239.221.170 (mx3/fortimail.ospedalesantandrea.it). Auth: SPF=pass; no DKIM or DMARC results shown in header. Likely misuse/compromise of a legitimate domain or outbound relay.Net owner: Fastweb SpA (AS12874). Suspected violations: unsolicited commercial email (CAN-SPAM principles), deceptive routing/identity, and RFC 5321/5322 best-practice violations for truthful, non-misleading email.
show less
Received on Fri, 30 Jan 2026 at 03:54:53 PST. Unsolicited commercial email advertising IPTV / stream ...
show moreReceived on Fri, 30 Jan 2026 at 03:54:53 PST. Unsolicited commercial email advertising IPTV / streaming services with deceptive marketing language, urgency prompts, and an external click-through hosted on a cloud storage service. The message was sent without consent and falsely implies prior interest. The content is purely promotional and bulk in nature, designed to drive traffic to an off-site landing page.
Header analysis shows sending IP 172.202.120.149 with mail server benyty4.hkrenoman.com (Azure cloud VM hostname make-172-202-120-149-rr1ums.centralus.cloudapp.azure.com). SPF passed, however no DKIM or DMARC authentication results are present, indicating incomplete email authentication and increased spoofing risk. The From field used a fabricated sender identity unrelated to the sending infrastructure, indicating impersonation.
show less
Received Tue, 27 Jan 2026 13:35:59 +0000. Source IP (X-Originating-IP): 51.83.205.40; sending MTA: m ...
show moreReceived Tue, 27 Jan 2026 13:35:59 +0000. Source IP (X-Originating-IP): 51.83.205.40; sending MTA: mail.madison-cruz-inc.com (51.83.205.40). Auth results show SPF=pass, DKIM=pass, DMARC=pass (p=NONE), so this appears to be authenticated bulk mail rather than a spoofed header.
Message presents as an unsolicited “Weekender/South Florida events” newsletter (“Chocolate fest… Secret Woods Nature Center…”) containing numerous tracking links and marketing language (“This is an advertisement”) plus list-unsubscribe mechanisms. Reporting as spam due to unwanted commercial email delivery.
ISP won't accept abuse report emails. All headers and IP address have to be manually submitted here: https://www.ovhcloud.com/en/abuse/
show less
Received Mon, 26 Jan 2026 14:38:38 -0800 (PST). Source mail server IP: 185.132.183.25 (mx07-003a9f01 ...
show moreReceived Mon, 26 Jan 2026 14:38:38 -0800 (PST). Source mail server IP: 185.132.183.25 (mx07-003a9f01.pphosted.com). Upstream sending IP observed in header chain: 185.91.69.136. Message presents itself as a business inquiry from “Fawaaz Global Associates” using [email protected] and asks the recipient to forward product specifications for large-quantity contracts tied to “foundation projects,” a common unsolicited procurement lure.
Email content is unsolicited B2B spam designed to solicit engagement and documents under a vague procurement pretext. The subject references forwarding product specifications to an unrelated third-party address, indicating lead harvesting or potential fraud setup. No prior relationship is indicated, and branding/domain usage appears misleading.
Authentication results show SPF=pass, DKIM=pass, DMARC=pass for logwin-logistics.com, meaning the domain authorized the send, but this does not legitimize the content. Likely violations include CAN-SPAM Act (15 USC 7701-7713)
show less
Received Mon, 26 Jan 2026 11:14:15 -0800 (PST). Suspected phishing/billing lure: “Access Bill.pdf an ...
show moreReceived Mon, 26 Jan 2026 11:14:15 -0800 (PST). Suspected phishing/billing lure: “Access Bill.pdf and keep a hard copy” with message “Invoice for your recent purchase is attached… Service Hotline: +1(983) 220-2377”. Sender appears as “Vinita Smith <[email protected]>” (likely impersonation / unsolicited invoice scam).
Sending client IP: 43.163.124.116 (connected to smtp.gmail.com via authenticated submission). Mail relay/server IP: 209.85.220.41 (mail-sor-f41.google.com). Authentication seen: SPF=pass and DKIM=pass for ctic.ro / Google; DMARC result not shown in header excerpt; ARC present.
This activity appears to violate the U.S. CAN-SPAM Act (deceptive/unsolicited commercial email) and, if used to obtain money/data, may implicate wire fraud statutes. It also conflicts with SMTP/email best practices (unsolicited phish delivery with attachment).
show less
Received Mon Jan 26 2026 05:33:36 PST (08:33:36 ET). Source IP: 149.72.184.219. Bulk marketing/newsl ...
show moreReceived Mon Jan 26 2026 05:33:36 PST (08:33:36 ET). Source IP: 149.72.184.219. Bulk marketing/newsletter “TQ Morning Briefing” via beehiiv/SendGrid: market commentary on gold/Fed/politics, multiple promotional partner ads, numerous tracking links, and one-click unsubscribe headers present. Auth results: SPF PASS; DKIM PASS (mail.beehiiv.com & sendgrid.info); DMARC PASS (aligned with beehiiv.com). No spoofing/auth failure seen; report as unsolicited commercial email if not subscribed. Potential legal issues if unsolicited/noncompliant: U.S. CAN-SPAM Act (15 USC 7701–7713) requirements (consent, opt-out, truthful headers). RFC: no obvious 5322/5321 violations. IP owner/abuse: Twilio SendGrid (SendGrid, Inc.), phone +1 888-985-7363, [email protected]
Over a dozen emails sent to [email protected] and THEY REFUSE to block my email from their servers. Legal action will have to be taken. This is harassment.
show less
Received Fri, 16 Jan 2026 20:14:18 +0000. Sending IP / mail server: 65.20.111.239 (EHLO customer-liv ...
show moreReceived Fri, 16 Jan 2026 20:14:18 +0000. Sending IP / mail server: 65.20.111.239 (EHLO customer-livehelpdesk.info). Message impersonates the Social Security Administration with subject “Your eStatement is Ready” and urges the recipient to download an “updated statement.”
Auth results in header: SPF=fail (domain does not authorize 65.20.111.239); DKIM=pass ([email protected]); DMARC=pass (p=none). Despite DMARC passing, the content is deceptive and designed to induce unsafe action.
Email includes an attachment “SSA_eStatement.zip” (a zipped payload), consistent with malware delivery and/or credential theft. Likely violations include CAN-SPAM (15 U.S.C. §7701–7713) and wire fraud/phishing (18 U.S.C. §1343). RFC issues: SPF per RFC 7208 failed; misleading header/content under RFC 5322. Abuse contact for the IP owner: [email protected].
show less
Received Thu, 22 Jan 2026 20:28:22 +0000. Suspected source: 212.227.17.24 (EHLO mout.kundenserver.de ...
show moreReceived Thu, 22 Jan 2026 20:28:22 +0000. Suspected source: 212.227.17.24 (EHLO mout.kundenserver.de / IONOS SE). Internal client seen: 147.124.210.21. The display-name in From impersonates DocuSign and falsely includes the recipient’s name/email to appear trusted.
Auth results: SPF=softfail (pradelgroup.com not authorizing 212.227.17.24); DKIM=unknown; DMARC=fail (p=none). Message is a “Completed: Please Sign” lure with an encoded reference and a prominent “REVIEW DOCUMENT” button directing to a non-DocuSign domain, consistent with credential-theft/phishing.
Likely violations: CAN-SPAM Act (15 U.S.C. §7701–7713) and fraud/phishing statutes (e.g., 18 U.S.C. §1343). RFC/authentication failures: RFC 7208 (SPF) and RFC 7489 (DMARC), plus misleading header identity under RFC 5322. Abuse contact for the sending network: [email protected].
show less
Received Sun, 25 Jan 2026 13:28:41 -0800 (PST). Mail server IP: 93.113.62.250 (sb0003.zuk.uk.com). O ...
show moreReceived Sun, 25 Jan 2026 13:28:41 -0800 (PST). Mail server IP: 93.113.62.250 (sb0003.zuk.uk.com). Other observed source IPs: 217.18.210.147 (X-Originating-IP) and 216.244.76.116 (efianalytics.com hop). From field used the recipient’s name falsely.Message is a “Cloud Storage / account blocked” scare lure claiming photos/videos will be deleted unless the user “renews” immediately, pushing a click-through button and unsubscribe link typical of phishing. Content uses urgency, threat of account loss, and misleading branding to trick the recipient into visiting a remote link and potentially entering credentials or payment data.Header auth: SPF=pass and DKIM=pass are shown; DMARC result is not present in the header, so DMARC status cannot be confirmed. This is abusive bulk/phishing mail with spoofed identity intent and deceptive header/content behavior. Spamcop reports [email protected] as host.
show less
Received 2026-01-21 04:02:09 PST. Unsolicited commercial spam advertising “Premium IPTV streaming” ( ...
show moreReceived 2026-01-21 04:02:09 PST. Unsolicited commercial spam advertising “Premium IPTV streaming” (“The way people actually watch TV”, “Cancel Anytime, No Contracts”). Message is polished HTML/CSS and attempts to drive clicks to an external landing page hosted on storage.googleapis.com (link.html with tracking fragment) with a “See how it works” call-to-action, plus an “Unsubscribe” link pointing to the same hosted page. Sending host/IP: 4.180.183.214 (…cloudapp.azure.com). Return-Path: [email protected] while From displays a different domain/name, consistent with bulk/throwaway sender identity. Authentication results shown: SPF=PASS; DKIM not shown; DMARC not shown. Likely CAN-SPAM concerns (unsolicited marketing, no clear consent; no visible physical postal address in body). Header practices may be inconsistent with RFC 5322 expectations for transparent, non-misleading origin metadata.
show less
Received Fri, 09 Jan 2026 18:55:19 +0000. Phishing email impersonating Amazon Prime: claims membersh ...
show moreReceived Fri, 09 Jan 2026 18:55:19 +0000. Phishing email impersonating Amazon Prime: claims membership renews and payment method is invalid, urging “Update Payment Method” and directing to a Google Docs link to steal credentials/payment info. Sender uses random domain b38.azatothrotten6.biz.id with “Prime Notification” display name.
Header auth: SPF=none (no permitted sender), DMARC=unknown for b38.azatothrotten6.biz.id, DKIM=pass (domain-signed but still fraudulent). Relay shows Google MX mail-dy1-f193.google.com (74.125.82.193) and an authenticated submission to smtp.gmail.com from 47.251.182.202.
This violates CAN-SPAM (deceptive header/subject, no valid consent) and constitutes phishing/identity deception (FTC Act 15 USC 45; likely wire fraud 18 USC 1343). Message format is misleading and non-compliant with RFC 5322/5321 best practices for truthful From/subject.
show less
Received Wed, 07 Jan 2026 at 13:24:08 +0000 (UTC). Unsolicited bulk commercial email claiming to be ...
show moreReceived Wed, 07 Jan 2026 at 13:24:08 +0000 (UTC). Unsolicited bulk commercial email claiming to be from “Jdsports Loyalty Rewards” offering Adidas sneakers for £9.99 and using urgency, voucher codes, and deceptive reward language. The message attempts to entice the recipient into clicking tracking links and providing personal or payment information under a fake loyalty reward pretext.
Sending IP: 81.19.140.67 (mail.customersforce.com). Mail server: atlas118.free.mail.bf1.yahoo.com. Authentication results show SPF=pass, DKIM=pass, DMARC=pass for customersforce.com; however, passing authentication does not legitimize unsolicited bulk marketing or deceptive reward scams.
This activity violates CAN-SPAM Act (15 U.S.C. §7701–7713) for deceptive commercial email and misleading subject lines, and misuses SMTP and email standards under RFC 5321 and RFC 5322 for spam distribution and fraud-oriented solicitation.
show less
Microsoft won't take responsibility for the spam and has no interest in doing anything about it.
...
show moreMicrosoft won't take responsibility for the spam and has no interest in doing anything about it.
Received Thu, 08 Jan 2026 10:58:53 -0800 (PST). Unsolicited scam/phish email impersonating a Microsoft online service notice and “NortonLifeLock renewal” for $499.99, pushing a phone number (1 805 331 5481) and “account email verification code”. Body says “Verify your email address” and code 823113, consistent with social-engineering to trigger a call/payment or credential capture.
Sending MTA/IP: CH4PR04CU002.outbound.protection.outlook.com [2a01:111:f403:c105::7] (Microsoft). Additional server: substrate.office.com [2603:10b6:a03:363::19]. Header auth on arrival: SPF=pass, DKIM=pass, DMARC=pass for microsoftonline.com; despite passing auth, message content is deceptive and abusive.
Likely violations: CAN-SPAM (15 U.S.C. 7701-7713) for deceptive commercial email; FTC Act (15 U.S.C. 45) deceptive practices; misuse of SMTP/message standards (RFC 5321/5322) for fraudulent solicitation.
show less
Received on Wed, 07 Jan 2026 at 15:34:35 -0800 (PST). Unsolicited bulk commercial email advertising ...
show moreReceived on Wed, 07 Jan 2026 at 15:34:35 -0800 (PST). Unsolicited bulk commercial email advertising fuel products (EN590 10PPM Diesel, D6, Jet A1) and requesting company profiles and buying requirements. The message was sent without prior consent and constitutes spam and attempted lead harvesting. The content promotes petroleum sales, claims storage at multiple ports, and urges engagement with “qualified buyers,” which is a classic B2B spam solicitation pattern.
Sending IP: 62.48.241.109 (mx1.ps.pt / mail.ps.pt). Originating IP shown: 158.173.152.44. Mail server path includes smtp.ps.pt and mx1.ps.pt. Authentication results show SPF=pass, DKIM=pass, DMARC=pass for domain ps.pt; however, passing authentication does not legitimize unsolicited bulk email. The From header shows Administrator [email protected] Reply-To points to [email protected] indicating third-party commercial solicitation via this infrastructure.
This activity violates CAN-SPAM (15 U.S.C. §7701-7713)
show less
Received Wed, 07 Jan 2026 17:20:09 -0800. Source MTA: m206.mxout.mta4.net (67.227.85.206); this appe ...
show moreReceived Wed, 07 Jan 2026 17:20:09 -0800. Source MTA: m206.mxout.mta4.net (67.227.85.206); this appears to be the sending IP and the outbound mail server.
Message claims to be an “2026 Annual Report Filing Notice” for RILEY RESEARCH CORPORATION (P13000000815), urging you to file an annual report between Jan 1 and May 1 to avoid $500+ late fees, and pushes you to use a paid filing service while stating it is not affiliated with any government agency. Contains tracking links and one-click unsubscribe.
Auth results: SPF PASS, DKIM PASS (myflcorpfiling.com + elasticemail.com), DMARC PASS. Network owner: Colocation America Corporation (AS21769). Abuse contact: [email protected]. Potential unsolicited commercial email; if deceptive/misleading, may implicate CAN-SPAM (15 USC 7701-7713) and FTC Act Section 5.
show less
Received 31 Dec 2025 17:01:06 +0000. Unsolicited marketing email promoting “AI for B2B” and a “free ...
show moreReceived 31 Dec 2025 17:01:06 +0000. Unsolicited marketing email promoting “AI for B2B” and a “free guide,” pushing tracked links; greeting says “Hi Chuck,” not the recipient, suggesting list-based targeting.
Sending/MTA IP: 96.45.68.119 (EHLO f119.mxout.mta4.net). Provider/host: Elastic Email (mxout.mta4.net). SPF=pass, DKIM=pass (sales-igniter.com and elasticemail.com), DMARC=pass (p=none) — authenticated delivery but still unwanted bulk.
Likely violations: CAN-SPAM Act (15 USC 7701–7713) if sent without consent and/or if opt-out is ineffective; questionable header practices vs RFC 5322/5321 norms (mis-targeted personalization, Reply-To differs). Abuse contact: [email protected] (also [email protected]).
show less
Received Wed, 31 Dec 2025 16:00:44 -0800 (PST). SMTP injection source: 159.112.241.55 (m241-55.mailg ...
show moreReceived Wed, 31 Dec 2025 16:00:44 -0800 (PST). SMTP injection source: 159.112.241.55 (m241-55.mailgun.net / X-Mailgun-Sending-Ip 159.112.241.55) delivering a bulk marketing message claiming to be “Kin Insurance” ([email protected]) urging the recipient to “Don’t renew your home insurance” and to click “Get a Quote”, with multiple tracking/unsubscribe headers present.
Auth results seen: SPF=PASS for [email protected] via 159.112.241.55; DKIM=PASS (cio29108.quotes.kin.com and mailgun.org); DMARC=PASS (p=NONE) for kin.com. Despite passing auth, this appears to be unsolicited commercial email and is being reported for abusive bulk sending from this infrastructure.
Potential violations: CAN-SPAM Act (15 U.S.C. § 7701–7713) if sent without consent and/or if opt-out is not honored; abusive use of SMTP contrary to RFC 5321/5322 operational expectations. IP owner/ESP appears to be Mailgun; abuse desk: [email protected] (also X-Report-Abuse-To: [email protected]).
show less
Received 31 Dec 2025 10:00:12 -0800. Source IP 54.240.73.27 (a73-27.smtp-out.amazonses.com / Amazon ...
show moreReceived 31 Dec 2025 10:00:12 -0800. Source IP 54.240.73.27 (a73-27.smtp-out.amazonses.com / Amazon SES). Unsolicited promo email claiming an “Amazon Prime members” special surprise and urging immediate credit-card approval; includes multiple tracking/redirect links and one-click unsubscribe. Branding implies affiliation with Amazon/Prime while sender domain is frugalfinanceway.com. Auth results: SPF PASS, DKIM PASS (frugalfinanceway.com & amazonses.com), DMARC PASS. Likely bulk marketing / phishing lure for financial signup; possible CAN-SPAM issues (15 U.S.C. §7704) if sent without consent and/or with deceptive subject/branding. Abuse: [email protected]. But if you email these to complain, they do absolutely nothing to stop the spam. BLACKLIST this mail server IP.
show less
Received Tue, 30 Dec 2025 07:09:38 -0800. Source IP: 96.45.68.35 (e35.mxout.mta4.net) sent an unsoli ...
show moreReceived Tue, 30 Dec 2025 07:09:38 -0800. Source IP: 96.45.68.35 (e35.mxout.mta4.net) sent an unsolicited commercial email promoting “Search AI” / “SearchAI” with repeated marketing claims (AI-driven wealth, “Netflix of AI,” lifetime access discount), urgency/pressure (“24 hours,” limited spots), coupon code, and multiple tracking/redirect links (tracking.d.dfyexpert.com) pushing a purchase/activation CTA. Message is bulk advertising with aggressive promotional language and link-heavy content typical of spam campaigns. Authentication results show SPF PASS, DKIM PASS (d.dfyexpert.com and elasticemail.com), and DMARC PASS; even with passing auth, this appears to be abusive mass-email marketing. Please investigate the sending customer/account on this IP and enforce opt-in requirements and complaint suppression. Potential CAN-SPAM concerns if unsolicited and/or if unsubscribe/opt-out is ineffective or misleading.
show less
Received 2025-12-26 04:01:59 -0800. Unsolicited procurement scam/impersonation: message claims to be ...
show moreReceived 2025-12-26 04:01:59 -0800. Unsolicited procurement scam/impersonation: message claims to be “TAQA T&D Group (Abu Dhabi National Energy Company)” seeking vendors/contractors and urges reply for “partnership guidelines”; generic outreach plus Reply-To ([email protected]) indicates phishing/social-engineering.
Sending infra: SMTP from mail.cegc.com.ar [200.80.202.28]; internal origin shown as [158.94.208.110]. From/Return-Path = [email protected] but display-name “TAQA T&D Group” is misleading (impersonation). Auth: SPF=pass; DMARC=pass; no DKIM result seen in this header.Likely violations: CAN-SPAM (deceptive header/unsolicited commercial email) and potential fraud/impersonation; also breaches messaging best-practices (RFC 5322/5321) via misleading identity and off-domain Reply-To. Please investigate abuse/compromise and halt further sends.
show less
Received Thu, 25 Dec 2025 07:01:01 -0800 (PST). Sending/mailserver IP: 54.240.78.217 (a78-217.smtp-o ...
show moreReceived Thu, 25 Dec 2025 07:01:01 -0800 (PST). Sending/mailserver IP: 54.240.78.217 (a78-217.smtp-out.amazonses.com, Amazon SES/AWS). Message is unsolicited political/health “alert” claiming “RFK Jr” is saving millions and urges recipients born before Jan 1, 1965 to click multiple tracking links to view the “warning,” typical affiliate/ad funnel behavior.
Auth results show SPF PASS, DKIM PASS (metropolisbenchmark.com and amazonses.com), and DMARC PASS (p=REJECT) for header.from=metropolisbenchmark.com—no SPF/DKIM/DMARC failures, but the content is still spam/phishing-like due to deceptive urgency and clickbait targeting.
Likely violations: CAN-SPAM (unsolicited commercial email, potentially misleading subject/claims, inadequate consent), and abusive bulk-mail practices contrary to RFC 5321/5322 norms. Abuse contact for this IP/service: [email protected].
show less
Received Wed, 24 Dec 2025 08:11:16 -0800 (PST). Source/mailserver: th6.neoserv.si (152.89.234.100). ...
show moreReceived Wed, 24 Dec 2025 08:11:16 -0800 (PST). Source/mailserver: th6.neoserv.si (152.89.234.100). Message claims a new account was created at cbd-slovenija.si and “welcomes” the recipient with a bizarre username referencing a Blogspot URL, “BINANCE,” and a large USD amount—classic automated registration spam with crypto bait, likely aiming to drive clicks or harvest credentials.
Auth results: SPF PASS for 152.89.234.100 and DKIM PASS ([email protected]). No DMARC result is shown in the header. Although authentication passes, the email is unsolicited and deceptive in content/context, consistent with phishing-style lures and abuse of a hosting mail server.
Likely host/abuse contact for 152.89.234.100: AVANT.SI d.o.o. (AS48894) via [email protected]. This activity appears to violate CAN-SPAM requirements for unsolicited commercial email and truthful header/content practices, and conflicts with SMTP/message format expectations in RFC 5321/5322 when used for abusive bulk mail.
show less
This unsolicited email was received on Wed, 24 Dec 2025 10:01:02 +0000. It claims to be a notificati ...
show moreThis unsolicited email was received on Wed, 24 Dec 2025 10:01:02 +0000. It claims to be a notification sent via goresolar.eu.com but actually promotes a supposed limited-time generator/reward offer using only remote images and multiple tracking links hosted on afrothecover.me, pressuring the recipient to click through for a “reward” or special deal.
The message originated from IP 63.141.233.218 (server identifying as maiueya.com), which also appears as the SMTP sending host for maritimemap.com. SPF for maritimemap.com passes, DKIM for goresolar.eu.com passes, and DMARC for goresolar.eu.com passes (p=REJECT), showing a fully authenticated but abusive campaign.
This appears to be unsolicited commercial email and likely a phishing lure designed to harvest personal or financial data, in violation of anti-spam and fraud laws such as the CAN-SPAM Act and general computer fraud statutes, as well as the spirit of RFC 5321/5322 on truthful sender identification and non-deceptive headers and subjects.
show less
Fraud OrdersPhishingWeb SpamEmail Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.