Received 31 Dec 2025 17:01:06 +0000. Unsolicited marketing email promoting “AI for B2B” and a “free ...
show moreReceived 31 Dec 2025 17:01:06 +0000. Unsolicited marketing email promoting “AI for B2B” and a “free guide,” pushing tracked links; greeting says “Hi Chuck,” not the recipient, suggesting list-based targeting.
Sending/MTA IP: 96.45.68.119 (EHLO f119.mxout.mta4.net). Provider/host: Elastic Email (mxout.mta4.net). SPF=pass, DKIM=pass (sales-igniter.com and elasticemail.com), DMARC=pass (p=none) — authenticated delivery but still unwanted bulk.
Likely violations: CAN-SPAM Act (15 USC 7701–7713) if sent without consent and/or if opt-out is ineffective; questionable header practices vs RFC 5322/5321 norms (mis-targeted personalization, Reply-To differs). Abuse contact: [email protected] (also [email protected]).
show less
Received Wed, 31 Dec 2025 16:00:44 -0800 (PST). SMTP injection source: 159.112.241.55 (m241-55.mailg ...
show moreReceived Wed, 31 Dec 2025 16:00:44 -0800 (PST). SMTP injection source: 159.112.241.55 (m241-55.mailgun.net / X-Mailgun-Sending-Ip 159.112.241.55) delivering a bulk marketing message claiming to be “Kin Insurance” ([email protected]) urging the recipient to “Don’t renew your home insurance” and to click “Get a Quote”, with multiple tracking/unsubscribe headers present.
Auth results seen: SPF=PASS for [email protected] via 159.112.241.55; DKIM=PASS (cio29108.quotes.kin.com and mailgun.org); DMARC=PASS (p=NONE) for kin.com. Despite passing auth, this appears to be unsolicited commercial email and is being reported for abusive bulk sending from this infrastructure.
Potential violations: CAN-SPAM Act (15 U.S.C. § 7701–7713) if sent without consent and/or if opt-out is not honored; abusive use of SMTP contrary to RFC 5321/5322 operational expectations. IP owner/ESP appears to be Mailgun; abuse desk: [email protected] (also X-Report-Abuse-To: [email protected]).
show less
Received 31 Dec 2025 10:00:12 -0800. Source IP 54.240.73.27 (a73-27.smtp-out.amazonses.com / Amazon ...
show moreReceived 31 Dec 2025 10:00:12 -0800. Source IP 54.240.73.27 (a73-27.smtp-out.amazonses.com / Amazon SES). Unsolicited promo email claiming an “Amazon Prime members” special surprise and urging immediate credit-card approval; includes multiple tracking/redirect links and one-click unsubscribe. Branding implies affiliation with Amazon/Prime while sender domain is frugalfinanceway.com. Auth results: SPF PASS, DKIM PASS (frugalfinanceway.com & amazonses.com), DMARC PASS. Likely bulk marketing / phishing lure for financial signup; possible CAN-SPAM issues (15 U.S.C. §7704) if sent without consent and/or with deceptive subject/branding. Abuse: [email protected]. But if you email these to complain, they do absolutely nothing to stop the spam. BLACKLIST this mail server IP.
show less
Received Tue, 30 Dec 2025 07:09:38 -0800. Source IP: 96.45.68.35 (e35.mxout.mta4.net) sent an unsoli ...
show moreReceived Tue, 30 Dec 2025 07:09:38 -0800. Source IP: 96.45.68.35 (e35.mxout.mta4.net) sent an unsolicited commercial email promoting “Search AI” / “SearchAI” with repeated marketing claims (AI-driven wealth, “Netflix of AI,” lifetime access discount), urgency/pressure (“24 hours,” limited spots), coupon code, and multiple tracking/redirect links (tracking.d.dfyexpert.com) pushing a purchase/activation CTA. Message is bulk advertising with aggressive promotional language and link-heavy content typical of spam campaigns. Authentication results show SPF PASS, DKIM PASS (d.dfyexpert.com and elasticemail.com), and DMARC PASS; even with passing auth, this appears to be abusive mass-email marketing. Please investigate the sending customer/account on this IP and enforce opt-in requirements and complaint suppression. Potential CAN-SPAM concerns if unsolicited and/or if unsubscribe/opt-out is ineffective or misleading.
show less
Received 2025-12-26 04:01:59 -0800. Unsolicited procurement scam/impersonation: message claims to be ...
show moreReceived 2025-12-26 04:01:59 -0800. Unsolicited procurement scam/impersonation: message claims to be “TAQA T&D Group (Abu Dhabi National Energy Company)” seeking vendors/contractors and urges reply for “partnership guidelines”; generic outreach plus Reply-To ([email protected]) indicates phishing/social-engineering.
Sending infra: SMTP from mail.cegc.com.ar [200.80.202.28]; internal origin shown as [158.94.208.110]. From/Return-Path = [email protected] but display-name “TAQA T&D Group” is misleading (impersonation). Auth: SPF=pass; DMARC=pass; no DKIM result seen in this header.Likely violations: CAN-SPAM (deceptive header/unsolicited commercial email) and potential fraud/impersonation; also breaches messaging best-practices (RFC 5322/5321) via misleading identity and off-domain Reply-To. Please investigate abuse/compromise and halt further sends.
show less
Received Thu, 25 Dec 2025 07:01:01 -0800 (PST). Sending/mailserver IP: 54.240.78.217 (a78-217.smtp-o ...
show moreReceived Thu, 25 Dec 2025 07:01:01 -0800 (PST). Sending/mailserver IP: 54.240.78.217 (a78-217.smtp-out.amazonses.com, Amazon SES/AWS). Message is unsolicited political/health “alert” claiming “RFK Jr” is saving millions and urges recipients born before Jan 1, 1965 to click multiple tracking links to view the “warning,” typical affiliate/ad funnel behavior.
Auth results show SPF PASS, DKIM PASS (metropolisbenchmark.com and amazonses.com), and DMARC PASS (p=REJECT) for header.from=metropolisbenchmark.com—no SPF/DKIM/DMARC failures, but the content is still spam/phishing-like due to deceptive urgency and clickbait targeting.
Likely violations: CAN-SPAM (unsolicited commercial email, potentially misleading subject/claims, inadequate consent), and abusive bulk-mail practices contrary to RFC 5321/5322 norms. Abuse contact for this IP/service: [email protected].
show less
Received Wed, 24 Dec 2025 08:11:16 -0800 (PST). Source/mailserver: th6.neoserv.si (152.89.234.100). ...
show moreReceived Wed, 24 Dec 2025 08:11:16 -0800 (PST). Source/mailserver: th6.neoserv.si (152.89.234.100). Message claims a new account was created at cbd-slovenija.si and “welcomes” the recipient with a bizarre username referencing a Blogspot URL, “BINANCE,” and a large USD amount—classic automated registration spam with crypto bait, likely aiming to drive clicks or harvest credentials.
Auth results: SPF PASS for 152.89.234.100 and DKIM PASS ([email protected]). No DMARC result is shown in the header. Although authentication passes, the email is unsolicited and deceptive in content/context, consistent with phishing-style lures and abuse of a hosting mail server.
Likely host/abuse contact for 152.89.234.100: AVANT.SI d.o.o. (AS48894) via [email protected]. This activity appears to violate CAN-SPAM requirements for unsolicited commercial email and truthful header/content practices, and conflicts with SMTP/message format expectations in RFC 5321/5322 when used for abusive bulk mail.
show less
This unsolicited email was received on Wed, 24 Dec 2025 10:01:02 +0000. It claims to be a notificati ...
show moreThis unsolicited email was received on Wed, 24 Dec 2025 10:01:02 +0000. It claims to be a notification sent via goresolar.eu.com but actually promotes a supposed limited-time generator/reward offer using only remote images and multiple tracking links hosted on afrothecover.me, pressuring the recipient to click through for a “reward” or special deal.
The message originated from IP 63.141.233.218 (server identifying as maiueya.com), which also appears as the SMTP sending host for maritimemap.com. SPF for maritimemap.com passes, DKIM for goresolar.eu.com passes, and DMARC for goresolar.eu.com passes (p=REJECT), showing a fully authenticated but abusive campaign.
This appears to be unsolicited commercial email and likely a phishing lure designed to harvest personal or financial data, in violation of anti-spam and fraud laws such as the CAN-SPAM Act and general computer fraud statutes, as well as the spirit of RFC 5321/5322 on truthful sender identification and non-deceptive headers and subjects.
show less
Received Mon, Dec 22 2025 07:01:40 PST. Source IP: 23.251.255.164 (e255-164.smtp-out.amazonses.com / ...
show moreReceived Mon, Dec 22 2025 07:01:40 PST. Source IP: 23.251.255.164 (e255-164.smtp-out.amazonses.com / Amazon SES, Amazon.com, Inc.). Unsolicited bulk email promoting an “AI Fuel” investment teaser/newsletter; pressures the reader to click tracked/redirected links to “get the ticker,” using hype language and exaggerated growth/return claims. Multiple tracking URLs and list-unsubscribe headers present, but message appears unwanted and abusive. Auth results: SPF=PASS, DKIM=PASS, DMARC=PASS (not spoofing, but still spam). May violate U.S. CAN-SPAM Act (15 U.S.C. §7701–7713) if sent without consent and/or with deceptive marketing claims. Report to AWS Trust & Safety: [email protected]
This is unsolicited commercial email; if sent without consent and/or with deceptive claims, it may implicate CAN-SPAM (15 U.S.C. § 7704).
show less
Received 15 Dec 2025 at 14:23:52 UTC an unsolicited email falsely claiming a completed 499.99 BTC-to ...
show moreReceived 15 Dec 2025 at 14:23:52 UTC an unsolicited email falsely claiming a completed 499.99 BTC-to-PayPal payment and pressuring the recipient to call a number to cancel. Message also states a “shared project” requires immediate review, a common tactic for financial and account-credential scams. The From field impersonates a known service, creating a misleading and deceptive sender identity.
Email was sent through SendGrid infrastructure with sending IP 159.183.98.243 and passed through Outlook protection at 40.93.1.36. SPF, DKIM and DMARC all pass for x.ai, showing the abuse is from a controlled or compromised sender account rather than forged headers. The content attempts to induce panic and obtain sensitive data and payment.
This traffic likely violates CAN-SPAM, wire fraud and computer fraud statutes by sending deceptive financial claims and manipulating a false urgent payment scenario. No RFC violations observed; abuse lies in intent and content. IP 159.183.98.243 is hosted by SendGrid/Twilio.
show less
Received 2025-12-17 06:13:08 PST (14:13:08 UTC). Unsolicited bulk email advertising paid BOI (Benefi ...
show moreReceived 2025-12-17 06:13:08 PST (14:13:08 UTC). Unsolicited bulk email advertising paid BOI (Beneficial Ownership Information) filing for “RILEY RESEARCH CORPORATION” and urging the recipient to click tracked links to “Get Started.” Message leverages fear/urgency around CTA/BOI compliance while stating it is not affiliated with any government entity—deceptive marketing aimed at collecting payment and sensitive business info. Multiple tracking URLs present. Auth: SPF=pass, DKIM=pass (myfloridacorpfilings.com & elasticemail.com), DMARC=pass. Source IP seen: 96.45.68.213 (mxout.mta4.net / Elastic Email).
Potential FTC deceptive advertising; also contrary to RFC/SMTP best practices.
show less
On 2025-12-16 at 16:02:24 PST I received an unsolicited bulk marketing email promoting Kin Insurance ...
show moreOn 2025-12-16 at 16:02:24 PST I received an unsolicited bulk marketing email promoting Kin Insurance home insurance quotes, sent via Mailgun/Customer.io. The message repeatedly pushes “updated” quote links, embeds many tracking parameters, and tries to re-engage me as a lead despite not requesting this contact.
The header shows it was sent from m241-55.mailgun.net with sending IP 159.112.241.55 and Return-Path [email protected]
. SPF, DKIM (kin.com and mailgun.org) and DMARC all PASS, confirming this is deliberate bulk traffic from a sender rather than a forged bounce or misdirected mail. Abuse contacts listed include [email protected]
and [email protected]
This unsolicited advertising may violate CAN-SPAM and other consumer protection and anti-spam laws if consent or prior opt-out preferences are being ignored. Please investigate this sender and take appropriate action against abusive use of 159.112.241.55 and related mail infrastructure.
They refuse to stop sending me spam.
show less
On 16 Dec 2025 at 15:08:46 PST I received an unsolicited commercial email advertising “Premium IPTV” ...
show moreOn 16 Dec 2025 at 15:08:46 PST I received an unsolicited commercial email advertising “Premium IPTV” with subject “A Year-End Gift for You — Premium IPTV Awaits Promotions #2811138131”. It was sent from 52.187.122.140 via nnnnnntooooname1.acconboy.com (make-52-187-122-140-rr1ums.southeastasia.cloudapp.azure.com), a Microsoft Azure host.
The HTML body pushes a “year-end gift” IPTV service, claiming thousands of channels, 4K quality and no contracts, and driving the recipient to a tracking link on Google Cloud storage to start streaming, plus an unsubscribe link that also uses tracking. This is IPTV marketing spam sent with no consent or prior relationship.
Headers show SPF pass for [email protected]
but no DKIM or DMARC alignment for the Elite_Streaming_Team From domain, weakening authentication and ignoring RFC guidance. This unsolicited advertising likely violates anti-spam laws such as the CAN-SPAM Act and misuses cloud server 52.187.122.140 for abusive email traffic.
show less
On 16 Dec 2025 at 02:59:20 UTC I received unsolicited email from IP 2a01:111:f403:d406::1 via Outloo ...
show moreOn 16 Dec 2025 at 02:59:20 UTC I received unsolicited email from IP 2a01:111:f403:d406::1 via Outlook server OS8PR02CU002.outbound.protection.outlook.com to several recipients, promoting an offer titled "GET BONUS 85" with a shared document link.
Message content encourages targets to click a Microsoft sharing URL to access a so-called bonus file, typical of credential-harvesting or malware-delivery spam. This appears to violate anti-spam and fraud laws such as the CAN-SPAM Act and computer fraud or wire fraud statutes by sending deceptive, unsolicited promotional/phishing email, and disregards email best-practice standards (e.g. RFC 5321/5322).
SPF, DKIM, and DMARC all pass for hotmail.com, indicating the sender is using valid Outlook or Hotmail infrastructure, likely via a compromised or misused mailbox. Please investigate activity from 2a01:111:f403:d406::1 and related outbound servers and suspend the abusive account. Abuse contact for this host appears to be [email protected]show less
Unsolicited Microsoft Teams email received 2025-12-12 at 06:42:12 PST. Headers show it originated fr ...
show moreUnsolicited Microsoft Teams email received 2025-12-12 at 06:42:12 PST. Headers show it originated from 4.190.215.225 (japanwest0.notifyp.svc.ms) and was relayed via 2a01:111:f403:dc05::1 (TYVP286CU001.outbound.protection.outlook.com) before delivery to Google.
Email masquerades as a “Microsoft Teams Subscription Auto-Renewal Notice” with invoice ID and fake charge of 599.98 USD, pressuring the recipient to call a phone number urgently to stop payment and avoid service interruption. This is a classic fake billing / tech-support scam designed to extract money or sensitive data.
SPF, DKIM and DMARC all pass for teams.mail.microsoft, so a legitimate Microsoft-related sending path is being abused. This deceptive unsolicited email violates CAN-SPAM and general anti-fraud laws by using misleading billing claims and coercive language. SMTP formatting appears RFC-compliant; abuse is in the fraudulent content. Please investigate and stop this traffic. Abuse contact: Microsoft, [email protected]
.
show less
Bulk email received 2025-12-13 at 15:40:02 PST. Header shows sending IP 149.72.120.146 (wrqvtvwn.out ...
show moreBulk email received 2025-12-13 at 15:40:02 PST. Header shows sending IP 149.72.120.146 (wrqvtvwn.outbound-mail.sendgrid.net) delivering mail from registermyathlete.com via mx.google.com. Message claims a partnership with BINANCE and that the recipient won a mining account holding 1.3421 BTC, urging the user to click tracking links and send “proof” in an online chat.
Body combines this crypto prize claim with an Aktivate/RegisterMyAthlete verification code and school-style branding, exploiting trust in a sports registration service to push a crypto scheme. SPF, DKIM (registermyathlete.com and sendgrid.info) and DMARC all pass, showing abuse of a SendGrid account rather than header forgery.
This likely violates CAN-SPAM and anti-fraud laws by sending deceptive investment spam and seeking engagement based on a fake reward. SMTP headers appear RFC-compliant; the key problem is misleading phishing-style crypto-scam content, so this IP and associated sender should be investigated and blocked.
show less
Unsolicited commercial stock-trading email received 2025-12-13 at 09:30:41 PST. Header shows sending ...
show moreUnsolicited commercial stock-trading email received 2025-12-13 at 09:30:41 PST. Header shows sending IP 54.240.79.243 (a79-243.smtp-out.amazonses.com, Amazon SES) delivering mail for metropolisbenchmark.com via mx.google.com. Message promotes a “superhuman stock AI” and trading forecasts the recipient never requested or consented to.
Body contains long promotional copy, tracking/redirect links and claims that users could triple their money every year, typical of bulk investment spam. SPF, DKIM (metropolisbenchmark.com and amazonses.com) and DMARC all pass, indicating abuse of a legitimate ESP account rather than simple forged headers.
This traffic appears to violate CAN-SPAM and similar anti-spam laws by sending unsolicited investment marketing with exaggerated performance claims and continued use of this address without valid consent. Although headers are RFC-compliant, the message is abusive bulk spam and should trigger investigation and possible termination of the sender’s account.
show less
PhishingEmail Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.