Unsolicited commercial email received on 2025-12-09 at 11:52:40 PST promoting “FL Filing Services/US ...
show moreUnsolicited commercial email received on 2025-12-09 at 11:52:40 PST promoting “FL Filing Services/US Filing Services” to file the 2026 Florida annual report for RILEY RESEARCH CORPORATION for $149 plus state fees. Content uses urgency, “Florida Compliance” branding, many tracking links and marketing language to push paid compliance-style services.
Header shows sending IP 159.183.11.177 via wfbthbbk.outbound-mail.sendgrid.net. SPF=pass, DKIM=pass (e.myfilingservices.com, sendgrid.info), DMARC=pass, so a legitimate mail platform is being used to send bulk unsolicited advertising to my address without any prior request.
This traffic may breach CAN-SPAM and similar anti-spam laws if sent without consent or in deceptive bulk form and likely violates the provider’s acceptable-use policies and email standards. Please investigate this sender and IP and take appropriate action. Abuse contact for the mail host is [email protected]
.
show less
Spam email received Thu, 04 Dec 2025 10:51:10 -0800, delivered from IP 4.241.176.12 (nnnnnntooooname ...
show moreSpam email received Thu, 04 Dec 2025 10:51:10 -0800, delivered from IP 4.241.176.12 (nnnnnntooooname1.gr88er.com). It advertises an IPTV streaming service, using hype and emojis and a big “Start Streaming Now” button plus tracking links, even though I never subscribed to or requested any messages from this sender.
Headers show mail going directly from this host to Google’s MX. SPF passes for nnnnnntooooname1.gr88er.com, but there is no DKIM or DMARC result for the sending domain, so the message is not authenticated. The From name “VisionTV_Deals” does not match the envelope sender, indicating obfuscated identity and likely spoofed bulk marketing.
This unsolicited commercial message appears to violate CAN-SPAM rules on unwanted advertising and truthful headers and conflicts with RFC 5321/5322 expectations for accurate addressing. Abuse originates from 4.241.176.12 on Microsoft Azure. Please investigate this system for spam; complaints can be sent to Microsoft’s abuse desk at [email protected]show less
This unsolicited message is a deceptive commercial spam claiming the recipient has won a “Free Oral- ...
show moreThis unsolicited message is a deceptive commercial spam claiming the recipient has won a “Free Oral-B Series 8 Reward,” attempting to lure the user into clicking multiple tracking URLs hosted on Google Cloud Storage. The content includes misleading incentives, fake loyalty program language, and embedded links designed to harvest personal information. The header shows a forged “From” display name and mismatched domains, indicating sender identity manipulation. SPF passed, but there is no DKIM signature from the sending domain and no DMARC results, failing authentication integrity. This violates CAN-SPAM by using misleading subject lines, false origin information, and sending without consent. Also violates RFC 5321/5322 for improper domain use and header construction.
show less
Unsolicited bulk marketing email received on Wed, 3 Dec 2025 at 16:20:30 +0000 to my business inbox, ...
show moreUnsolicited bulk marketing email received on Wed, 3 Dec 2025 at 16:20:30 +0000 to my business inbox, promoting automotive showroom traffic and Christmas sales from “Philip Calvert / Pinnacle Direct” via Mailchimp infrastructure (mail62.suw231.rsgsv.net, IP 198.2.174.62). Message appears to be part of a large Mailchimp campaign sent without my consent and using my address for repeated commercial advertising. SPF, DKIM and DMARC all pass; headers show no obvious RFC 5321/5322 syntax errors, but this traffic is unsolicited commercial email and may violate CAN-SPAM and similar anti-spam laws when sent without permission or honoring opt-out.
show less
The spam message was received on Tue, 02 Dec 2025 19:36:09 +0000 and originated from IP 84.234.98.10 ...
show moreThe spam message was received on Tue, 02 Dec 2025 19:36:09 +0000 and originated from IP 84.234.98.109 using a forged domain and a falsified From field that used the recipient’s name. The email promoted deceptive Medicare and loan relief ads and contained numerous tracking links and image-based redirects designed to harvest personal data. The sending domain failed SPF and DMARC showed unknown status, indicating improper authentication and likely spoofing.
The header shows the message passed through atlas211.free.mail.ne1.yahoo.com before delivery, and the SMTP sending host identified itself fraudulently. The content is misleading commercial spam sent without consent and includes unsubscribe information that appears nonfunctional. This violates CAN-SPAM requirements, RFC 5321/5322 standards for proper sender identity, and prohibits falsified routing data.
The campaign uses misleading subject lines, forged reply paths, and cloaked redirect URLs, consistent with phishing or deceptive marketing operations.
show less
Unsolicited bulk commercial email received Tue, 02 Dec 2025 at 15:08:59 -0800 (PST) advertising an “ ...
show moreUnsolicited bulk commercial email received Tue, 02 Dec 2025 at 15:08:59 -0800 (PST) advertising an “Omaha Steaks” Great Steaks Sampler and falsely claiming I am “today’s winner” with pre-filled customer/account details and multiple tracking/redirect links hosted on a cloud storage site. Message uses a misleading From name (“PromoOmahaSteaks” with a random domain) and subject (“Free Today”) to impersonate a well-known brand and coerce clicks to claim a “reward”. SPF for infostar.emotebot.com passed for 4.155.209.143, but no DKIM or DMARC results are shown, so the message is effectively unauthenticated marketing spam. This appears to violate CAN-SPAM (deceptive subject/headers, unsolicited promo) and to disregard RFC 5321/5322 guidance on truthful header fields, and may form part of an online fraud scheme (similar to wire-fraud/phishing). Please investigate and terminate abusive use of this host.
show less
Unsolicited bulk marketing email received 2025-12-01 06:18:39 PST via 159.183.119.125 for a “Remote ...
show moreUnsolicited bulk marketing email received 2025-12-01 06:18:39 PST via 159.183.119.125 for a “Remote Closing Academy / remote sales closer” course, sent through SendGrid/beehiiv using bc.remoteclosingacademy.com with tracking links and list-unsubscribe headers. Message claims I “used to be interested” and pushes a video link and coaching offer, asking for a reply, but I did not request or authorize this contact. SPF=pass and DKIM=pass for bc.remoteclosingacademy.com and sendgrid.info; DMARC status not shown in the snippet. Traffic appears to breach anti-spam laws such as the CAN-SPAM Act for unsolicited commercial email. No obvious RFC 5321/5322 syntax errors, but this IP is being used for persistent unwanted Email Spam. Please investigate, suspend the sender, and purge them from your mailing platform.
show less
Date/Time Received: Tue, 25 Nov 2025 06:15:03 PST
Unsolicited bulk marketing email promoting a “gol ...
show moreDate/Time Received: Tue, 25 Nov 2025 06:15:03 PST
Unsolicited bulk marketing email promoting a “gold investing” opportunity sent via Amazon SES from IP 23.251.255.157 on behalf of capitalstrategix.com. Message attempts to draw the recipient into clicking tracking links and marketing funnels using newsletter-style copy and promotional hype about “the world’s largest gold buyer” and 100x gains. Although SPF, DKIM and DMARC all pass for the sending domains (amazonses.com and capitalstrategix.com), this appears to be non-consensual commercial email and part of a mass-mailing campaign, not a one-to-one contact. The content embeds multiple tracking and unsubscribe URLs and claims the recipient “made a great decision” to receive the newsletter, which is misleading. This behavior constitutes unsolicited commercial email (spam) and an abuse of a bulk mail service contrary to email best practices and RFC 5321/5322 expectations.
show less
This message was an unsolicited IPTV advertisement sent using a forged “From” field that impersonate ...
show moreThis message was an unsolicited IPTV advertisement sent using a forged “From” field that impersonated the recipient’s name falsely. The header shows that the email originated from 4.239.126.9 and was transmitted through infonewsmxts.matheusarruda.com without any prior authorization. The message promotes a Black Friday IPTV streaming service and uses deceptive unsubscribe links hosted on Google Cloud Storage. Although SPF passed, the domains used are unrelated and likely part of a bulk-spam operation. DKIM and DMARC validation for the sender domain are absent, indicating no verifiable identity, violating standard authentication expectations. This behavior constitutes unsolicited commercial email, sender identity spoofing, misuse of cloud hosting, and a clear breach of email best-practice and RFC 5321/5322 requirements.
show less
Spam email received Tue, 25 Nov 2025 at 04:18:04 PST from sending IP 140.205.208.204 via mail server ...
show moreSpam email received Tue, 25 Nov 2025 at 04:18:04 PST from sending IP 140.205.208.204 via mail server out208-204.dm.aliyun.com. Message is a sexually explicit marketing blast promoting adult toys, discount codes and graphic content, sent without consent and designed to push traffic to external commercial sites using tracking links and redirects.
SPF, DKIM and DMARC all pass for quantisel.com, suggesting either a compromised sender or intentional abuse of a bulk-mail system on 140.205.208.204. Content uses obfuscated wording, heavy imagery and encoded URLs and is part of an ongoing campaign despite no prior relationship or subscription with the sender.
This unsolicited adult commercial mail appears to violate CAN-SPAM and other anti-spam laws requiring consent, clear identification and non-deceptive practices. It conflicts with the intent of RFC 5321 and RFC 5322 by using legitimate infrastructure for deceptive, unwanted bulk advertising. Please investigate and stop abuse from 140.205.208.204.
show less
On 22 Nov 2025 at 06:15:07 PST (14:15:06 UTC) I received an unsolicited bulk “work from home / extra ...
show moreOn 22 Nov 2025 at 06:15:07 PST (14:15:06 UTC) I received an unsolicited bulk “work from home / extra income” email promoting Capital Strategix real-estate funding offers. It urges the reader to “start collecting checks” by helping find investors who need funding, wrapped in a long advertorial newsletter with repeated calls to “get all the details”.
The email was sent via Amazon SES from a79-168.smtp-out.amazonses.com (IP 54.240.79.168). SPF, DKIM and DMARC all pass for amazonses.com and capitalstrategix[dot]com, so the traffic is not spoofed but is abusive use of a bulk mail service to push speculative financial schemes without any prior relationship or consent.
This traffic appears to violate anti-spam and deceptive marketing laws such as the CAN-SPAM Act if sent without valid permission and a working opt-out. Headers seem syntactically compliant with email RFCs; the abuse lies in the unsolicited, misleading commercial content. Please investigate; AWS abuse contact is [email protected]show less
Unsolicited spam received Fri, 21 Nov 2025 09:19:04 -0800 via Gmail, using authenticated submission ...
show moreUnsolicited spam received Fri, 21 Nov 2025 09:19:04 -0800 via Gmail, using authenticated submission from this EC2 host (35.86.222.251) as SMTP client. Message spoofs an “ORDER DI-186666 F TD” notification from “Stephanie Wills <...>” and instructs the recipient to open an attached HEIC image file (“Bloomington, IN 47401.heic”) with only the text “Please check your attachment for details.” The content and fake order reference strongly suggest phishing / malware delivery rather than any legitimate prior business. SPF, DKIM and DMARC all pass for gmail.com, which indicates the sender is abusing a real Gmail account from this compromised server to bypass basic filters. This activity appears to violate anti-spam and computer misuse laws (e.g. CAN-SPAM and similar statutes) and should be investigated and blocked. Headers are syntactically valid with no obvious RFC 5321/5322 violations; the abuse is the deceptive, unsolicited content and malicious attachment.
show less
On Thu, 20 Nov 2025 20:10:27 -0800 (PST) I received a spam email claiming I had been “chosen” to cla ...
show moreOn Thu, 20 Nov 2025 20:10:27 -0800 (PST) I received a spam email claiming I had been “chosen” to claim a free Oral-B Series 8 reward from UnitedHealthcare if I completed a short online survey. The HTML body is a generic prize promotion using urgency to push me to click links and submit personal details.
The message pretends to be from “UnitedHealthcare” <[email protected] , but the Return-Path is [email protected] and it was sent from 4.196.100.84 (make-4-196-100-84-rr1ums.australiaeast.cloudapp.azure.com). SPF passes for infostar.getinspiredflight.com, but there is no DKIM or DMARC result shown and the sender and domains do not match the brand being used.
This unsolicited mail appears to violate CAN-SPAM and anti-phishing/fraud laws by using misleading headers, a deceptive subject and attempts to harvest data under false pretenses, contrary to RFC 5321/5322. Please investigate abuse from 4.196.100.84 and terminate any account or campaign responsible.
show less
This report concerns unsolicited bulk email received on Thu, 20 Nov 2025 02:54:43 -0800, advertising ...
show moreThis report concerns unsolicited bulk email received on Thu, 20 Nov 2025 02:54:43 -0800, advertising explicit adult products and discount codes under the subject “[1 Alert] Calling all deal hunters...”. The message is a mass-marketing HTML campaign containing numerous tracked links to third-party commercial sites and promotional images, sent without any prior consent.
The sending IP observed in the header is 140.205.208.223, used by host out208-223.dm.aliyun.com via smtp.aliyun-inc.com. SPF, DKIM, and DMARC all show “pass”, indicating the sender is intentionally using authenticated infrastructure to push high-volume adult marketing. This traffic appears to violate CAN-SPAM style anti-spam principles by sending unwanted sexually explicit promotions to a personal mailbox.
show less
Spamcop says: ISP does not wish to receive reports. These people are not even accountable for spam ...
show moreSpamcop says: ISP does not wish to receive reports. These people are not even accountable for spam!
On 18 Nov 2025 at 09:58:08 PST I received unsolicited email from [email protected] via mail.hostingregion.com (IP 174.127.120.4). The message is a sales pitch for custom logo mats, asking to send a price list and promote LogoMats Inc, with no prior business relationship or consent.
Headers show SPF=pass, DKIM=pass and DMARC=pass for hostingregion.com, so this is authenticated bulk marketing, not a spoof. SMTP headers look RFC 5321/5322 compliant, but the content is unsolicited advertising and appears to lack a clear unsubscribe option, which likely violates CAN-SPAM and similar anti-spam laws on unsolicited email marketing.
This reflects abusive use of mail.hostingregion.com to send bulk Email Spam / Web Spam, likely using purchased or harvested email lists. Please investigate this sender and take appropriate action. Public information shows the network operator as UK-2 Limited /
show less
On Tue, 04 Nov 2025 13:32:05 -0800 I received an unsolicited “Quick Introduction” email to my email ...
show moreOn Tue, 04 Nov 2025 13:32:05 -0800 I received an unsolicited “Quick Introduction” email to my email address, claiming to be from a private investor named Hazza Bin Zayed Al Nahyan offering funding for various projects, with no prior contact or relationship. The content is a generic investment pitch aimed at collecting replies from random recipients.
Headers show it was sent from mail.correodelasalud.com using IP 200.29.238.238 to Google’s MX. SPF passes for clinicasanrafael.net, DKIM returns permerror (no key found), and DMARC passes, so a legitimate-looking domain and server are being used to send this unsolicited message.
This behavior appears to violate CAN-SPAM and similar anti-spam laws by sending unrequested commercial offers without consent, sender identification, or a clear opt-out. RFC 5321/5322 syntax is largely valid; the problem is deceptive unsolicited content abusing authenticated infrastructure. Please investigate and stop abuse from 200.29.238.238
show less
Unsolicited bulk investment-advertising email received on Wed, 19 Nov 2025 at 06:15:19 -0800 (PST). ...
show moreUnsolicited bulk investment-advertising email received on Wed, 19 Nov 2025 at 06:15:19 -0800 (PST). Message claims I “missed Nvidia” and urges me to buy Elon Musk’s so-called “silent partner” AI stock, using sensational profit claims, multiple tracking links and images, and a long promotional pitch from Brownstone Research/Capital Strategix. I never requested or consented to mail from this sender; this is abusive list-based marketing, not a one-to-one message. Headers show sending via a79-118.smtp-out.amazonses.com (54.240.79.118) using Amazon SES. SPF, DKIM, and DMARC all PASS, so the bulk mail is authenticated, not spoofed. Although superficially RFC-compliant (valid headers and auth), it likely violates anti-spam laws such as CAN-SPAM by sending unsolicited commercial email with aggressive, potentially misleading subject matter and tracking. Please investigate and terminate this spam activity.
show less
Received on 2025-11-18 at 22:50:19 PST this unsolicited bulk commercial email from “EveryoneSez” via ...
show moreReceived on 2025-11-18 at 22:50:19 PST this unsolicited bulk commercial email from “EveryoneSez” via Twilio SendGrid (o343.sh1.decipherinc.com / 159.183.128.243). Message pushes an “entertainment influencer” survey panel, promising advance access to movies/TV and cash, PayPal and gift-card rewards, with multiple tracking links/pixels. I never requested nor consented to any mail from this sender, so this is classic UBE/lottery-style spam and may be used to harvest personal data. SPF, DKIM and DMARC all pass, confirming it is sent through a bulk-mail platform, not a forged bounce. Activity appears to breach typical anti-spam acceptable-use policies and may be non-compliant with CAN-SPAM or similar anti-spam laws governing deceptive unsolicited advertising. Please investigate and terminate abusive use of this IP.
show less
Unsolicited bulk spam received on 2025-11-18 at 22:28:04 PST. Message claims I am a “3rd winner” and ...
show moreUnsolicited bulk spam received on 2025-11-18 at 22:28:04 PST. Message claims I am a “3rd winner” and pressures me to click tracking links hosted on Google Cloud storage to complete a fake 30-second pharmacy survey and claim a supposed cash/reward offer. The visible From name impersonates a trusted pharmacy/rewards brand while the envelope sender and sending host are unrelated Azure infrastructure, indicating sender identity spoofing and a likely phishing/lottery-style scam designed to harvest personal data or payment details. Only SPF passes for a different domain; no aligned DKIM or DMARC results are present for the From domain, so the message effectively bypasses proper authentication. Content violates CAN-SPAM (deceptive subject and misleading prize claim) and disregards email best-practice RFCs by using forged/obscured origin and embedded scripting-style markup.
show less
The message was received on Sun, 16 Nov 2025 at 12:31 PM PST and was an unsolicited commercial email ...
show moreThe message was received on Sun, 16 Nov 2025 at 12:31 PM PST and was an unsolicited commercial email promoting work-from-home real estate programs. The sending IP shown in the header is 209.85.220.65 and the mail server handling the transmission was mail-sor-f65.google.com. The header shows that the From field used the recipient’s name as false, attempting to disguise the sender’s identity.
The SPF, DKIM, and DMARC checks passed because the spammer used a valid Gmail relay, but the content was still deceptive and unsolicited. The Reply-To address redirects to a third-party marketing server, indicating intentional evasion. This behavior violates CAN-SPAM, misuses SMTP infrastructure, and breaches multiple RFC requirements involving truthful sender identity and permission-based sending.
The activity is consistent with email spam and spoofing through a hosted mail server. The network owner of the IP is Google LLC. Abuse reports may be sent to [email protected]show less
Received Sat, 25 Oct 2025 04:45:30 +0000. Message was a commercial bulk advertisement titled “Scary ...
show moreReceived Sat, 25 Oct 2025 04:45:30 +0000. Message was a commercial bulk advertisement titled “Scary good deals with payments as low as $289 a month,” sent from Delray Hyundai [email protected] through drivequote360.com. The body contained numerous tracking links and embedded pixels hosted on clk.drivequote360.com and CloudFront domains. Message was unsolicited marketing disguised as a personalized offer, delivered to my inbox without prior consent.
Authentication: SPF pass; DKIM pass (s=smtp d=auto.drivequote360.com); DMARC pass (p=REJECT, sp=REJECT). Sending IP 212.236.225.237 (prod-237.eagarden.com); relay 10.253.62.154 (yahoo). Host appears to be Easynet/HostRoyale under “The Hosting Solution LLC.” Abuse contact: [email protected]
Violations include CAN-SPAM Act (15 U.S.C. §7701 et seq.) for unsolicited advertising and header misrepresentation; breaches of RFC 5321/5322 for bulk mail without clear opt-in and tracking tags that circumvent privacy standards.
show less
Received Sun, 26 Oct 2025 03:20:25 +0000. Message impersonated “Adidas newsletter / Jude Bellingham ...
show moreReceived Sun, 26 Oct 2025 03:20:25 +0000. Message impersonated “Adidas newsletter / Jude Bellingham collection,” but was actually a mass-mail advertisement for “Night Vision Pro – 50% Off” hosted at monalisassmile.com with multiple tracking links and image beacons. Uses fake branding, counterfeit logos, and embedded redirect chains to unrelated commerce domains—clearly unsolicited promotional spam designed to harvest clicks.
Authentication: SPF pass, DKIM pass (aliyun-ap-southeast-1), DMARC pass (p=NONE) for monalisassmile.com; so the message originated from a real but misused host. Sending IP 8.219.35.208 (out35-208.sg.b.dm.aliyun.com) and relay 10.197.40.105 (yahoo atlas117). Abuse contact for the sending host: [email protected]
Likely CAN-SPAM Act violation (15 U.S.C. §7701 et seq.) for unsolicited advertising and misleading headers. Standards breaches include misrepresentation of message origin and header fields contrary to RFC 5321 and RFC 5322 (email authenticity and header integrity).
show less
Received Wed, 29 Oct 2025 00:47:46 +0000. Bulk commercial blast advertising a “72-Hour Sale” for a c ...
show moreReceived Wed, 29 Oct 2025 00:47:46 +0000. Bulk commercial blast advertising a “72-Hour Sale” for a car dealer with many tracking links, call/CHAT CTAs, and fine-print pricing. Unsolicited marketing to my address; subject uses merge tag “[FNAME]” and mass-mailer links.
Authentication: SPF pass for bpupdates0523.com; DKIM pass (s=default d=bpupdates0523.com); DMARC pass (p=NONE) for header.from=bpupdates0523.com. No SPF/DKIM/DMARC failures observed.
Routing: sending IP 146.59.9.237 (mail.bpupdates0523.com) delivering to Yahoo’s atlas-production host; internal handoff seen via 10.214.173.215 and localhost line from Yahoo. Likely host: OVHcloud (AS OVH SAS). Abuse contact: [email protected]
Potential violations: CAN-SPAM (15 U.S.C. §7701 et seq.) if sent without consent or proper opt-out handling; standards concerns include excessive tracking and misleading personalization contrary to best practices in RFC 5322 guidance.
show less
Received Fri, 07 Nov 2025 00:22:14 +0000 by atlas-production.v2-mail-prod1-bf1.omega.yahoo.com. Mess ...
show moreReceived Fri, 07 Nov 2025 00:22:14 +0000 by atlas-production.v2-mail-prod1-bf1.omega.yahoo.com. Message originated from 154.62.26.44 (EHLO flagitate.cafechaweng.com) with Return-Path [email protected]
Internal mail server hop noted at 10.197.32.200 (SMTPs). Subject: “7 Signs of Magnesium Deficiency You Shouldn't Ignore.”
uthentication: SPF=pass (154.62.26.44 permitted), DKIM=pass (d=messaging-way.net, s=dkim), DMARC=pass (p=REJECT). Despite aligned auth, this is unsolicited bulk advertising with tracking links, characteristic of UBE.
Abuse summary: Unwanted commercial email routed from 154.62.26.44 promoting “Golden Years Bliss.” This appears non-compliant with the CAN-SPAM Act (15 U.S.C. §7701 et seq.) if sent without prior consent and for deceptive/scare-tactic content; no clear RFC 5321/5322 header failures observed. Please investigate and suspend the sender/source.
show less
Received Tue, Nov 4, 2025 23:41:51 PST. Bulk crypto promo “Asterdex Official Token Distribution Noti ...
show moreReceived Tue, Nov 4, 2025 23:41:51 PST. Bulk crypto promo “Asterdex Official Token Distribution Notice” with subject “Claim Your Token:” urging “Check Eligibility” via tracking link (click.correo.verti.es). Unsolicited, designed to induce sign-in/“verification.” Auth: SPF=pass (13.111.34.128), DKIM=pass (correo.verti.es; s7.y.mc.salesforce.com), DMARC=pass (from=verti.es), ARC present. Despite auth passes, content is deceptive and unwanted; please investigate/suppress. Potential legal issues: CAN-SPAM (15 U.S.C. §7701 et seq.) for unsolicited/deceptive commercial email; FTC Act §5 (deceptive practices). RFC notes: bulk mail with List-Unsubscribe; no obvious protocol failures—abuse is content-based.
show less
Fraud OrdersPhishingWeb SpamEmail Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.