Received Mon, Dec 22 2025 07:01:40 PST. Source IP: 23.251.255.164 (e255-164.smtp-out.amazonses.com / ...
show moreReceived Mon, Dec 22 2025 07:01:40 PST. Source IP: 23.251.255.164 (e255-164.smtp-out.amazonses.com / Amazon SES, Amazon.com, Inc.). Unsolicited bulk email promoting an “AI Fuel” investment teaser/newsletter; pressures the reader to click tracked/redirected links to “get the ticker,” using hype language and exaggerated growth/return claims. Multiple tracking URLs and list-unsubscribe headers present, but message appears unwanted and abusive. Auth results: SPF=PASS, DKIM=PASS, DMARC=PASS (not spoofing, but still spam). May violate U.S. CAN-SPAM Act (15 U.S.C. §7701–7713) if sent without consent and/or with deceptive marketing claims. Report to AWS Trust & Safety: [email protected]
This is unsolicited commercial email; if sent without consent and/or with deceptive claims, it may implicate CAN-SPAM (15 U.S.C. § 7704).
show less
Received 15 Dec 2025 at 14:23:52 UTC an unsolicited email falsely claiming a completed 499.99 BTC-to ...
show moreReceived 15 Dec 2025 at 14:23:52 UTC an unsolicited email falsely claiming a completed 499.99 BTC-to-PayPal payment and pressuring the recipient to call a number to cancel. Message also states a “shared project” requires immediate review, a common tactic for financial and account-credential scams. The From field impersonates a known service, creating a misleading and deceptive sender identity.
Email was sent through SendGrid infrastructure with sending IP 159.183.98.243 and passed through Outlook protection at 40.93.1.36. SPF, DKIM and DMARC all pass for x.ai, showing the abuse is from a controlled or compromised sender account rather than forged headers. The content attempts to induce panic and obtain sensitive data and payment.
This traffic likely violates CAN-SPAM, wire fraud and computer fraud statutes by sending deceptive financial claims and manipulating a false urgent payment scenario. No RFC violations observed; abuse lies in intent and content. IP 159.183.98.243 is hosted by SendGrid/Twilio.
show less
Received 2025-12-17 06:13:08 PST (14:13:08 UTC). Unsolicited bulk email advertising paid BOI (Benefi ...
show moreReceived 2025-12-17 06:13:08 PST (14:13:08 UTC). Unsolicited bulk email advertising paid BOI (Beneficial Ownership Information) filing for “RILEY RESEARCH CORPORATION” and urging the recipient to click tracked links to “Get Started.” Message leverages fear/urgency around CTA/BOI compliance while stating it is not affiliated with any government entity—deceptive marketing aimed at collecting payment and sensitive business info. Multiple tracking URLs present. Auth: SPF=pass, DKIM=pass (myfloridacorpfilings.com & elasticemail.com), DMARC=pass. Source IP seen: 96.45.68.213 (mxout.mta4.net / Elastic Email).
Potential FTC deceptive advertising; also contrary to RFC/SMTP best practices.
show less
On 2025-12-16 at 16:02:24 PST I received an unsolicited bulk marketing email promoting Kin Insurance ...
show moreOn 2025-12-16 at 16:02:24 PST I received an unsolicited bulk marketing email promoting Kin Insurance home insurance quotes, sent via Mailgun/Customer.io. The message repeatedly pushes “updated” quote links, embeds many tracking parameters, and tries to re-engage me as a lead despite not requesting this contact.
The header shows it was sent from m241-55.mailgun.net with sending IP 159.112.241.55 and Return-Path [email protected]
. SPF, DKIM (kin.com and mailgun.org) and DMARC all PASS, confirming this is deliberate bulk traffic from a sender rather than a forged bounce or misdirected mail. Abuse contacts listed include [email protected]
and [email protected]
This unsolicited advertising may violate CAN-SPAM and other consumer protection and anti-spam laws if consent or prior opt-out preferences are being ignored. Please investigate this sender and take appropriate action against abusive use of 159.112.241.55 and related mail infrastructure.
They refuse to stop sending me spam.
show less
On 16 Dec 2025 at 15:08:46 PST I received an unsolicited commercial email advertising “Premium IPTV” ...
show moreOn 16 Dec 2025 at 15:08:46 PST I received an unsolicited commercial email advertising “Premium IPTV” with subject “A Year-End Gift for You — Premium IPTV Awaits Promotions #2811138131”. It was sent from 52.187.122.140 via nnnnnntooooname1.acconboy.com (make-52-187-122-140-rr1ums.southeastasia.cloudapp.azure.com), a Microsoft Azure host.
The HTML body pushes a “year-end gift” IPTV service, claiming thousands of channels, 4K quality and no contracts, and driving the recipient to a tracking link on Google Cloud storage to start streaming, plus an unsubscribe link that also uses tracking. This is IPTV marketing spam sent with no consent or prior relationship.
Headers show SPF pass for [email protected]
but no DKIM or DMARC alignment for the Elite_Streaming_Team From domain, weakening authentication and ignoring RFC guidance. This unsolicited advertising likely violates anti-spam laws such as the CAN-SPAM Act and misuses cloud server 52.187.122.140 for abusive email traffic.
show less
On 16 Dec 2025 at 02:59:20 UTC I received unsolicited email from IP 2a01:111:f403:d406::1 via Outloo ...
show moreOn 16 Dec 2025 at 02:59:20 UTC I received unsolicited email from IP 2a01:111:f403:d406::1 via Outlook server OS8PR02CU002.outbound.protection.outlook.com to several recipients, promoting an offer titled "GET BONUS 85" with a shared document link.
Message content encourages targets to click a Microsoft sharing URL to access a so-called bonus file, typical of credential-harvesting or malware-delivery spam. This appears to violate anti-spam and fraud laws such as the CAN-SPAM Act and computer fraud or wire fraud statutes by sending deceptive, unsolicited promotional/phishing email, and disregards email best-practice standards (e.g. RFC 5321/5322).
SPF, DKIM, and DMARC all pass for hotmail.com, indicating the sender is using valid Outlook or Hotmail infrastructure, likely via a compromised or misused mailbox. Please investigate activity from 2a01:111:f403:d406::1 and related outbound servers and suspend the abusive account. Abuse contact for this host appears to be [email protected]show less
Unsolicited Microsoft Teams email received 2025-12-12 at 06:42:12 PST. Headers show it originated fr ...
show moreUnsolicited Microsoft Teams email received 2025-12-12 at 06:42:12 PST. Headers show it originated from 4.190.215.225 (japanwest0.notifyp.svc.ms) and was relayed via 2a01:111:f403:dc05::1 (TYVP286CU001.outbound.protection.outlook.com) before delivery to Google.
Email masquerades as a “Microsoft Teams Subscription Auto-Renewal Notice” with invoice ID and fake charge of 599.98 USD, pressuring the recipient to call a phone number urgently to stop payment and avoid service interruption. This is a classic fake billing / tech-support scam designed to extract money or sensitive data.
SPF, DKIM and DMARC all pass for teams.mail.microsoft, so a legitimate Microsoft-related sending path is being abused. This deceptive unsolicited email violates CAN-SPAM and general anti-fraud laws by using misleading billing claims and coercive language. SMTP formatting appears RFC-compliant; abuse is in the fraudulent content. Please investigate and stop this traffic. Abuse contact: Microsoft, [email protected]
.
show less
Bulk email received 2025-12-13 at 15:40:02 PST. Header shows sending IP 149.72.120.146 (wrqvtvwn.out ...
show moreBulk email received 2025-12-13 at 15:40:02 PST. Header shows sending IP 149.72.120.146 (wrqvtvwn.outbound-mail.sendgrid.net) delivering mail from registermyathlete.com via mx.google.com. Message claims a partnership with BINANCE and that the recipient won a mining account holding 1.3421 BTC, urging the user to click tracking links and send “proof” in an online chat.
Body combines this crypto prize claim with an Aktivate/RegisterMyAthlete verification code and school-style branding, exploiting trust in a sports registration service to push a crypto scheme. SPF, DKIM (registermyathlete.com and sendgrid.info) and DMARC all pass, showing abuse of a SendGrid account rather than header forgery.
This likely violates CAN-SPAM and anti-fraud laws by sending deceptive investment spam and seeking engagement based on a fake reward. SMTP headers appear RFC-compliant; the key problem is misleading phishing-style crypto-scam content, so this IP and associated sender should be investigated and blocked.
show less
Unsolicited commercial stock-trading email received 2025-12-13 at 09:30:41 PST. Header shows sending ...
show moreUnsolicited commercial stock-trading email received 2025-12-13 at 09:30:41 PST. Header shows sending IP 54.240.79.243 (a79-243.smtp-out.amazonses.com, Amazon SES) delivering mail for metropolisbenchmark.com via mx.google.com. Message promotes a “superhuman stock AI” and trading forecasts the recipient never requested or consented to.
Body contains long promotional copy, tracking/redirect links and claims that users could triple their money every year, typical of bulk investment spam. SPF, DKIM (metropolisbenchmark.com and amazonses.com) and DMARC all pass, indicating abuse of a legitimate ESP account rather than simple forged headers.
This traffic appears to violate CAN-SPAM and similar anti-spam laws by sending unsolicited investment marketing with exaggerated performance claims and continued use of this address without valid consent. Although headers are RFC-compliant, the message is abusive bulk spam and should trigger investigation and possible termination of the sender’s account.
show less
Unsolicited commercial email received on 2025-12-09 at 11:52:40 PST promoting “FL Filing Services/US ...
show moreUnsolicited commercial email received on 2025-12-09 at 11:52:40 PST promoting “FL Filing Services/US Filing Services” to file the 2026 Florida annual report for RILEY RESEARCH CORPORATION for $149 plus state fees. Content uses urgency, “Florida Compliance” branding, many tracking links and marketing language to push paid compliance-style services.
Header shows sending IP 159.183.11.177 via wfbthbbk.outbound-mail.sendgrid.net. SPF=pass, DKIM=pass (e.myfilingservices.com, sendgrid.info), DMARC=pass, so a legitimate mail platform is being used to send bulk unsolicited advertising to my address without any prior request.
This traffic may breach CAN-SPAM and similar anti-spam laws if sent without consent or in deceptive bulk form and likely violates the provider’s acceptable-use policies and email standards. Please investigate this sender and IP and take appropriate action. Abuse contact for the mail host is [email protected]
.
show less
Spam email received Thu, 04 Dec 2025 10:51:10 -0800, delivered from IP 4.241.176.12 (nnnnnntooooname ...
show moreSpam email received Thu, 04 Dec 2025 10:51:10 -0800, delivered from IP 4.241.176.12 (nnnnnntooooname1.gr88er.com). It advertises an IPTV streaming service, using hype and emojis and a big “Start Streaming Now” button plus tracking links, even though I never subscribed to or requested any messages from this sender.
Headers show mail going directly from this host to Google’s MX. SPF passes for nnnnnntooooname1.gr88er.com, but there is no DKIM or DMARC result for the sending domain, so the message is not authenticated. The From name “VisionTV_Deals” does not match the envelope sender, indicating obfuscated identity and likely spoofed bulk marketing.
This unsolicited commercial message appears to violate CAN-SPAM rules on unwanted advertising and truthful headers and conflicts with RFC 5321/5322 expectations for accurate addressing. Abuse originates from 4.241.176.12 on Microsoft Azure. Please investigate this system for spam; complaints can be sent to Microsoft’s abuse desk at [email protected]show less
This unsolicited message is a deceptive commercial spam claiming the recipient has won a “Free Oral- ...
show moreThis unsolicited message is a deceptive commercial spam claiming the recipient has won a “Free Oral-B Series 8 Reward,” attempting to lure the user into clicking multiple tracking URLs hosted on Google Cloud Storage. The content includes misleading incentives, fake loyalty program language, and embedded links designed to harvest personal information. The header shows a forged “From” display name and mismatched domains, indicating sender identity manipulation. SPF passed, but there is no DKIM signature from the sending domain and no DMARC results, failing authentication integrity. This violates CAN-SPAM by using misleading subject lines, false origin information, and sending without consent. Also violates RFC 5321/5322 for improper domain use and header construction.
show less
Unsolicited bulk marketing email received on Wed, 3 Dec 2025 at 16:20:30 +0000 to my business inbox, ...
show moreUnsolicited bulk marketing email received on Wed, 3 Dec 2025 at 16:20:30 +0000 to my business inbox, promoting automotive showroom traffic and Christmas sales from “Philip Calvert / Pinnacle Direct” via Mailchimp infrastructure (mail62.suw231.rsgsv.net, IP 198.2.174.62). Message appears to be part of a large Mailchimp campaign sent without my consent and using my address for repeated commercial advertising. SPF, DKIM and DMARC all pass; headers show no obvious RFC 5321/5322 syntax errors, but this traffic is unsolicited commercial email and may violate CAN-SPAM and similar anti-spam laws when sent without permission or honoring opt-out.
show less
The spam message was received on Tue, 02 Dec 2025 19:36:09 +0000 and originated from IP 84.234.98.10 ...
show moreThe spam message was received on Tue, 02 Dec 2025 19:36:09 +0000 and originated from IP 84.234.98.109 using a forged domain and a falsified From field that used the recipient’s name. The email promoted deceptive Medicare and loan relief ads and contained numerous tracking links and image-based redirects designed to harvest personal data. The sending domain failed SPF and DMARC showed unknown status, indicating improper authentication and likely spoofing.
The header shows the message passed through atlas211.free.mail.ne1.yahoo.com before delivery, and the SMTP sending host identified itself fraudulently. The content is misleading commercial spam sent without consent and includes unsubscribe information that appears nonfunctional. This violates CAN-SPAM requirements, RFC 5321/5322 standards for proper sender identity, and prohibits falsified routing data.
The campaign uses misleading subject lines, forged reply paths, and cloaked redirect URLs, consistent with phishing or deceptive marketing operations.
show less
Unsolicited bulk commercial email received Tue, 02 Dec 2025 at 15:08:59 -0800 (PST) advertising an “ ...
show moreUnsolicited bulk commercial email received Tue, 02 Dec 2025 at 15:08:59 -0800 (PST) advertising an “Omaha Steaks” Great Steaks Sampler and falsely claiming I am “today’s winner” with pre-filled customer/account details and multiple tracking/redirect links hosted on a cloud storage site. Message uses a misleading From name (“PromoOmahaSteaks” with a random domain) and subject (“Free Today”) to impersonate a well-known brand and coerce clicks to claim a “reward”. SPF for infostar.emotebot.com passed for 4.155.209.143, but no DKIM or DMARC results are shown, so the message is effectively unauthenticated marketing spam. This appears to violate CAN-SPAM (deceptive subject/headers, unsolicited promo) and to disregard RFC 5321/5322 guidance on truthful header fields, and may form part of an online fraud scheme (similar to wire-fraud/phishing). Please investigate and terminate abusive use of this host.
show less
Unsolicited bulk marketing email received 2025-12-01 06:18:39 PST via 159.183.119.125 for a “Remote ...
show moreUnsolicited bulk marketing email received 2025-12-01 06:18:39 PST via 159.183.119.125 for a “Remote Closing Academy / remote sales closer” course, sent through SendGrid/beehiiv using bc.remoteclosingacademy.com with tracking links and list-unsubscribe headers. Message claims I “used to be interested” and pushes a video link and coaching offer, asking for a reply, but I did not request or authorize this contact. SPF=pass and DKIM=pass for bc.remoteclosingacademy.com and sendgrid.info; DMARC status not shown in the snippet. Traffic appears to breach anti-spam laws such as the CAN-SPAM Act for unsolicited commercial email. No obvious RFC 5321/5322 syntax errors, but this IP is being used for persistent unwanted Email Spam. Please investigate, suspend the sender, and purge them from your mailing platform.
show less
Date/Time Received: Tue, 25 Nov 2025 06:15:03 PST
Unsolicited bulk marketing email promoting a “gol ...
show moreDate/Time Received: Tue, 25 Nov 2025 06:15:03 PST
Unsolicited bulk marketing email promoting a “gold investing” opportunity sent via Amazon SES from IP 23.251.255.157 on behalf of capitalstrategix.com. Message attempts to draw the recipient into clicking tracking links and marketing funnels using newsletter-style copy and promotional hype about “the world’s largest gold buyer” and 100x gains. Although SPF, DKIM and DMARC all pass for the sending domains (amazonses.com and capitalstrategix.com), this appears to be non-consensual commercial email and part of a mass-mailing campaign, not a one-to-one contact. The content embeds multiple tracking and unsubscribe URLs and claims the recipient “made a great decision” to receive the newsletter, which is misleading. This behavior constitutes unsolicited commercial email (spam) and an abuse of a bulk mail service contrary to email best practices and RFC 5321/5322 expectations.
show less
This message was an unsolicited IPTV advertisement sent using a forged “From” field that impersonate ...
show moreThis message was an unsolicited IPTV advertisement sent using a forged “From” field that impersonated the recipient’s name falsely. The header shows that the email originated from 4.239.126.9 and was transmitted through infonewsmxts.matheusarruda.com without any prior authorization. The message promotes a Black Friday IPTV streaming service and uses deceptive unsubscribe links hosted on Google Cloud Storage. Although SPF passed, the domains used are unrelated and likely part of a bulk-spam operation. DKIM and DMARC validation for the sender domain are absent, indicating no verifiable identity, violating standard authentication expectations. This behavior constitutes unsolicited commercial email, sender identity spoofing, misuse of cloud hosting, and a clear breach of email best-practice and RFC 5321/5322 requirements.
show less