synthetic-motor-oil-change-and-filters.com

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of synthetic-motor-oil-change-and-filters.com joined AbuseIPDB in June 2025 and has reported 1,637 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇸 198.2.175.99	31 Aug 2025	Received Fri, 29 Aug 2025 17:43:57 +0000. Unsolicited real-estate marketing email titled “Just Sold ... show more Received Fri, 29 Aug 2025 17:43:57 +0000. Unsolicited real-estate marketing email titled “Just Sold Another Successful Sale! Congrats to the New Owners,” promoting a Cupertino property (10424 Dempster Ave, $3,200,000) with detailed features, multiple tracking links/pixels, and a “GET STARTED” CTA. Sending IP / MTA: 198.2.175.99 (mail99.suw151.rsgsv.net). Host: The Rocket Science Group LLC (Mailchimp). Abuse contact: [email protected] show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇺🇸 198.2.175.99	31 Aug 2025	Received Fri, 29 Aug 2025 17:43:57 +0000. Message delivered via Mailchimp infrastructure: sending IP ... show more Received Fri, 29 Aug 2025 17:43:57 +0000. Message delivered via Mailchimp infrastructure: sending IP 198.2.175.99 (mail99.suw151.rsgsv.net), handed to Yahoo MTA 10.214.155.146 over TLS1.3. Promotional real-estate email titled “Just Sold…Congrats to the New Owners,” from “Rachel” at kw.com, publicizing sale of 10424 Dempster Ave, Cupertino CA for $3,200,000. Includes detailed property features, links to rachelghomes.com, Mailchimp tracking, Instagram/YouTube, and call-to-action buttons. SPF: pass; DKIM: pass (fbl.mcsv.net & kw.com); DMARC: pass (p=none). No obvious RFC 5321/5322, 7208, 6376, 7489 failures. If unsolicited and/or opt-out ignored, potential CAN-SPAM issues (15 U.S.C. §7704). Report host: Mailchimp (The Rocket Science Group). Abuse contact: [email protected] show less	Fraud Orders Web Spam Email Spam
🇩🇪 51.77.95.65	31 Aug 2025	Received Thu, 28 Aug 2025 15:32:20 +0000 via atlas113.free.mail.bf1.yahoo.com. Sending IP 51.77.95.6 ... show more Received Thu, 28 Aug 2025 15:32:20 +0000 via atlas113.free.mail.bf1.yahoo.com. Sending IP 51.77.95.65 (EHLO sn2.ebilling-quickbooks.help); receiving MTA logged 10.197.39.235 (Yahoo internal). Authentication shows SPF=pass, DKIM=pass, DMARC=pass for ebilling-quickbooks.help, yet the message impersonates Intuit. Content: “Payment Issue with QuickBooks Subscription” claims a failed renewal and urges calling +1-805-695-6578 to “update payment.” High priority and a blank “List-Unsubscribe” mailto. This is a billing-support phone-phish intended to harvest card details and/or money. Host likely: OVH SAS (OVHcloud) for 51.77.95.65; abuse contact: [email protected] show less	Fraud Orders Phishing Web Spam Email Spam Spoofing
🇭🇰 150.109.34.23	29 Aug 2025	Received: Aug 29, 2025 10:40:49 EDT. Fake “McAfee renewal” invoice claiming USD 434.77 for a 5-year ... show more Received: Aug 29, 2025 10:40:49 EDT. Fake “McAfee renewal” invoice claiming USD 434.77 for a 5-year plan, urging a call to +1-865-287-5313. Subject “Payment logged for Invoice Id 2641-lpbssfl.” From display name impersonates the recipient. Refund-bait scam. Auth results: SPF=pass, DKIM=pass, DMARC=pass (gmail.com) — indicates a Gmail account sent it (not a forward). Sending client IP: 150.109.34.23 (authenticated to smtp.gmail.com). Relayed by: 209.85.220.41 (mail-sor-f41.google.com). Categories to tick: Email Spam; Phishing; Spoofing; Fraud Orders. Laws/RFC: Violates U.S. CAN-SPAM (15 U.S.C. §7701 et seq.) and attempts wire fraud (18 U.S.C. §1343). Misleading originator fields contravene RFC 5322 §3.6.2. Host: Tencent Cloud (AS132203); abuse: [email protected] ; phone: +86-400-910-0100 / 95716. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇯🇵 219.117.227.89	28 Aug 2025	Received Aug 27, 2025 15:07 PDT. Advance-fee/inheritance lure: claims to be an attorney (“Confidenti ... show more Received Aug 27, 2025 15:07 PDT. Advance-fee/inheritance lure: claims to be an attorney (“Confidential Legal matters”) referencing a deceased client with a shared surname and asks for a reply to a different mailbox. Clear social-engineering scam.Sending IP (client): 192.227.217.223 (likely origin). Mail server IP: 219.117.227.89 cs.ifcomputer.co.jp (forwarding MTA). SPF: pass for ifcomputer.co.jp; DKIM: not present in header; DMARC: not shown; ARC: cv=none. From display name “Ronald Evergreen” with Reply-To mismatch indicates deceptive intent.Likely violations: CAN-SPAM (15 U.S.C. §7704 — deceptive pretext; no valid physical address/opt-out) and wire-fraud statute (18 U.S.C. §1343). RFC notes: DKIM absent (RFC 6376); DMARC result absent (RFC 7489); misleading header semantics contravene RFC 5322’s intent. Provider contacts—ColoCrossing (owner of 192.227.217.223): [email protected], +1-800-518-9716. NTT PC Communications (219.117.227.89 host for cs.ifcomputer.co.jp): [email protected], +81-3-6203-2703 show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇯🇵 60.36.166.34	28 Aug 2025	Received Aug 27, 2025 08:55:33 PDT via 60.36.166.34 (msc112.plala.or.jp). Message is an advance-fee/ ... show more Received Aug 27, 2025 08:55:33 PDT via 60.36.166.34 (msc112.plala.or.jp). Message is an advance-fee/lottery-donation hoax: claims an $842.4M Powerball win and offers $10M, directing the target to contact “Mr. John Hoag” at [email protected] with code TBC-97121USA, plus requests full PII and ID/passport; cites “U.S. government monitoring” and a CIBC Bank contact +1-917-392-7199. Auth results: SPF pass; DKIM pass (plala.or.jp); DMARC pass (p=none). Reply-To mismatch used to divert responses. Likely violations: CAN-SPAM (15 U.S.C. §7704) for deceptive/unsolicited solicitation; attempted wire fraud (18 U.S.C. §1343) and identity-theft solicitation; contravenes RFC 5322 header-field semantics (misleading From/Reply-To). Origin IP owner: NTT DOCOMO/Plala (plala.or.jp); abuse: [email protected]; phone: 0120-971-391 / 0570-008-887. All headers retained and reported. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 149.72.30.221	27 Aug 2025	Received Aug 27, 2025 02:56:52 PDT. Unsolicited explicit marketing email advertising “9 Vibrating Sp ... show more Received Aug 27, 2025 02:56:52 PDT. Unsolicited explicit marketing email advertising “9 Vibrating Spring & 5 Vacuum Suction Penis Pump with 2 Switchable Sleeves” with multiple tracking links. Sent via o36.mailer.shopify.com; sending IP 149.72.30.221. Mail server: o36.mailer.shopify.com (149.72.30.221). Authentication: SPF pass (mailer.g.shopifyemail.com designates 149.72.30.221), DKIM pass (g.shopifyemail.com; sendgrid.info), DMARC pass (shopifyemail.com). Headers show “Precedence: bulk” and List-Unsubscribe/One-Click. Origin appears to be Shopify Email delivered through Twilio SendGrid (AS11377). Abuse: [email protected] show less	Fraud Orders Phishing Web Spam Email Spam
🇮🇪 159.183.224.0	26 Aug 2025	Received Mon, 25 Aug 2025 15:05:08 −0700 (PDT). Sending/mailserver IP: 159.183.224.0 via s.wfbtzhhh. ... show more Received Mon, 25 Aug 2025 15:05:08 −0700 (PDT). Sending/mailserver IP: 159.183.224.0 via s.wfbtzhhh.outbound-mail.sendgrid.net (SendGrid/AS11377). From: Cole McCann [email protected]. Subject: “Your personal data has leaked”. Message is an extortion/sextortion scam alleging device compromise, webcam/mic control, and threatens to publish recordings unless 12,000 USD in bitcoin is paid. Auth results from header: SPF=pass (client-ip 159.183.224.0), DKIM=pass (d=ldoncoffee.com; s=s1), DMARC=not present in header; ARC cv=none. Malicious social-engineering; no legitimate prior relationship. Likely violations: 18 U.S.C. §875(d) (extortion), 18 U.S.C. §1343 (wire fraud), and CAN-SPAM (15 U.S.C. §7701 et seq.) for deceptive subject/content. No obvious RFC 5321/5322 header-format violations observed; abuse lies in content/intent. Hosting: Twilio SendGrid — report to [email protected] show less	Fraud Orders Phishing Web Spam Email Spam Hacking Spoofing
🇺🇸 159.183.200.47	23 Aug 2025	Never signed up to receive emails from these people.	Web Spam Email Spam
🇨🇦 51.161.73.164	21 Aug 2025	Received on Aug 21, 2025 18:10:36 -0400. Message delivered via mx.google.com from mann.therests.co [ ... show more Received on Aug 21, 2025 18:10:36 -0400. Message delivered via mx.google.com from mann.therests.co [51.161.73.164]; previous hop njmta-53.sailthru.com [173.228.155.53]. Subject “Please Check Your account.” From field used the recipient’s name falsely. Email claims urgent account review and payout confirmation, pushes “Confirm/Verify” links hosted behind obfuscated storage URLs, with junk filler text to evade filters. Content unsolicited and deceptive, attempting to harvest credentials/payment info under guise of security notice/newsletter. Auth results: SPF PASS for data-updates.tools.commerce.gov.extraordic.com via 51.161.73.164; DKIM PERMERROR (no public key) for o8bxom.3zdsvi.xwkt7l.us; DMARC not shown/unaligned. Violations: CAN-SPAM (15 U.S.C. §7704) misleading headers/subject; potential wire fraud (18 U.S.C. §1343); RFC 5322/5321 header spoofing and identifier misalignment. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 95.168.160.83	21 Aug 2025		Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 163.172.81.246	21 Aug 2025	Received Thu, Aug 21, 2025 13:48:55 PDT. Unsolicited gambling promo (“400% Bonus up to €2000 + 145 F ... show more Received Thu, Aug 21, 2025 13:48:55 PDT. Unsolicited gambling promo (“400% Bonus up to €2000 + 145 Free Spins”) with redirect/tracking links and obfuscated text; no prior consent. These headers are being reported to the hosting providers; ongoing identical spam shows the host ignores complaints and delivery continues. Auth: SPF pass ([email protected] via 163.172.81.246); DKIM permerror (no key) for xb5hfz.21n306.21xwai.us; DMARC not shown and domains misaligned, so DMARC likely fails. Header anomalies indicate RFC 5322/7208/6376/7489 issues. Likely violates CAN-SPAM (15 U.S.C. §7701 et seq.) for deceptive headers & unsolicited ads. Sending IP: 163.172.81.246 (Scaleway/Online S.A.S — [email protected]). Mail server in chain: 173.228.155.53 njmta-53.sailthru.com (NYI — [email protected]). Please terminate the source and enforce AUP; persistent spam indicates inadequate enforcement. show less	Fraud Orders Web Spam Email Spam Spoofing Exploited Host
🇺🇸 149.72.116.219	21 Aug 2025	Received on Aug 21, 2025 16:06 ET. Unsolicited bulk marketing “You left items in your cart” from “Mi ... show more Received on Aug 21, 2025 16:06 ET. Unsolicited bulk marketing “You left items in your cart” from “Mixedesire” via Shopify Email/SendGrid. Contains tracking links/pixel and one-click unsubscribe, but I never subscribed and messages persist. Source MTA: o37.mailer.shopify.com [149.72.116.219]. Auth results show SPF=pass, DKIM=pass (g.shopifyemail.com, sendgrid.info), DMARC=pass (shopifyemail.com); so not a spoof, but unsolicited. Likely CAN-SPAM §7704 violations (unsolicited marketing, continued sending after complaints). No obvious RFC 5321/5322 violations in header. Please investigate and terminate sender; host appears unresponsive to abuse as spam continues. Network owner: Twilio SendGrid — [email protected] / [email protected]. show less	Fraud Orders Phishing Web Spam Email Spam
🇳🇱 95.168.160.83	21 Aug 2025	Received Aug 21, 2025 12:52:15 PDT (15:52:15 EDT). Fraud email claims a “$5,000.50 direct deposit,” ... show more Received Aug 21, 2025 12:52:15 PDT (15:52:15 EDT). Fraud email claims a “$5,000.50 direct deposit,” hides behind a fake delivery-status (multipart/report) and heavy base64/HTML noise, and pushes obfuscated links (incl. storage.googleapis.*)—classic credential-harvest phish. The From display name reused the recipient’s own name to mislead. Auth: SPF PASS for a return path at auth.email-secure.us.dramational.com via 95.168.160.83; DKIM permerror (no key) for rdyzmduomwykhkmdqxkqxlfb.com; DMARC alignment fails (SPF domain not aligned with From). Received chain shows balistreri.jamesonally.com.de [95.168.160.83] as sending host. Please investigate, disable the source, and remove related landing pages/assets. Categories to tick: Email Spam, Phishing, Spoofing. Likely host/abuse desk (for 95.168.160.0/20, AS60781): LeaseWeb — abuse: [email protected] , phone: +31 20 316 2880 (global contact page also lists [email protected] and support numbers). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇹🇷 89.252.173.119	21 Aug 2025	Unsolicited casino/gambling promo received Aug 21, 2025 14:48:09 -0400. Delivered via cronin.kongzhi ... show more Unsolicited casino/gambling promo received Aug 21, 2025 14:48:09 -0400. Delivered via cronin.kongzhiduan.com [89.252.173.119] to Google. MAIL FROM domain wdf4ds-14efde6-d4fg.platforway.com passed SPF, but the visible From “Casino Exclusive” uses 93r3xy.vyjq90.p4mnmh.us → clear domain/header misalignment (spoofing). DKIM=permerror (no public key for d=93r3xy.vyjq90.p4mnmh.us). No DMARC result visible; alignment therefore fails. Content uses redirector links and “free spins” inducements typical of bulk spam. Laws/RFCs: CAN-SPAM (15 U.S.C. §§7701–7713: unsolicited commercial email & misleading header info); RFC 5322/5321 (misleading From), RFC 6376 (DKIM unverifiable), RFC 7489 (DMARC misalignment). Please investigate and disable the sender at 89.252.173.119. IP owner & abuse desk for 89.252.173.119: Netinternet Bilisim Teknolojileri AS (AS51559) — Abuse: [email protected] — Phone: +90 850 885 08 85. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇨🇿 89.185.250.182	21 Aug 2025	Received Aug 21, 2025 at 14:40 −0400. Unsolicited bulk message advertising “concealed carry help”/ex ... show more Received Aug 21, 2025 at 14:40 −0400. Unsolicited bulk message advertising “concealed carry help”/expedited permit with “50% off,” many tracking links and an “unsubscribe.” Body is heavily obfuscated (random strings/base64) and mislabeled as multipart/report. Delivered via 89.185.250.182 (moorganization.online; sl-reverse rDNS). Auth: SPF PASS on dynastige.com (envelope); DKIM PERMERROR (no key) for g35ecq.0k79t2.iuo47c.us; no DMARC result shown; From/Return-Path misalignment indicates spoofing. Mixed “Sailthru” Received lines inconsistent with source suggest forged headers or an exploited host. Violations: CAN-SPAM (15 U.S.C. §7704) deceptive/unsolicited email; potential 18 U.S.C. §1343 (fraud) where used to obtain data; RFC 5321/5322 header/authentication non-compliance. Host/abuse contact for 89.185.250.182: MasterDC s.r.o. (aka Master Internet) — [email protected] +420 515 919 805 (NOC/Abuse). Alt: +420 777 919 484. 89.185.250.182 sits in 89.185.250.0/24 announced by AS24971 MasterDC show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 95.168.160.83	21 Aug 2025	Received Aug 21, 2025 at 2:20 PM EDT. Unsolicited bulk email advertising “Miracle_Sheets,” stuffed w ... show more Received Aug 21, 2025 at 2:20 PM EDT. Unsolicited bulk email advertising “Miracle_Sheets,” stuffed with obfuscated payloads, tracking/redirect links, fake unsubscribe, and credential-harvesting lures (“account information,” “activate your account,” etc.). Authentication: SPF PASS for leverbavoir.auth.email-secure.us.incipatier.com (but not aligned with visible From); DKIM PERMERROR (no key) for fwyspmfvwdqlewrjusgepdjm.com; DMARC not shown—likely FAIL due to misalignment. Origination IP seen in Received: 95.168.160.83. Compliance: violates CAN-SPAM (15 U.S.C. §7701 et seq.) via deceptive headers/subject & no valid opt-out; attempted phishing implicates 18 U.S.C. §1343/§1028. RFC issues: malformed Date ending with a period (RFC 5322 §3.3) and misuse of multipart/report for marketing (RFC 3462/6522). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇫🇷 188.138.125.173	21 Aug 2025	Received Aug 21, 2025 at 13:51 EDT. Unsolicited adult/medical marketing with deceptive subject and m ... show more Received Aug 21, 2025 at 13:51 EDT. Unsolicited adult/medical marketing with deceptive subject and multiple obfuscated redirect links (incl. storage.googleapis[.]com) intended to solicit clicks/credentials. Delivered to Google by 188.138.125.173 (EHLO slowles.objectingular.co.uk; reverse shows 188-138-125-173.dynamic-ip.hinet.net — mismatch/likely forged). Return-Path uses rforeg6drgf-…-theoretive.com. Auth results: SPF PASS for theoretive.com; DKIM PERMERROR (no key for d=v4fjw4.7mtv7s.olcvri.us); no DMARC result shown/alignment absent. Headers show Google added a missing Message-ID, indicating malformed construction. Activity appears to violate CAN-SPAM (15 U.S.C. §§7701-7713: deceptive subject/unsolicited adult marketing, nonfunctional opt-out/physical address absent) and is non-compliant with email RFCs (5321/5322 trace/From consistency; 6376 DKIM invalid). Please investigate and block abuse from the noted host/IP. Host/abuse contact for 188.138.125.173: PlusServer GmbH (Host Europe / AS8972) show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 205.201.134.117	21 Aug 2025	Received on Aug 20, 2025 at 15:40:56 UTC. Promotional bulk email from “Jakprints” sent via Mailchimp ... show more Received on Aug 20, 2025 at 15:40:56 UTC. Promotional bulk email from “Jakprints” sent via Mailchimp infrastructure (mail117.atl31.mcdlv.net, 205.201.134.117). Subject: “Borrow our T-Shirt Cannon FREE”. Microsoft filtering scored it SCL=6. Authentication results: SPF=pass for mail117.atl31.mcdlv.net; DKIM=pass for jakprints.com; DMARC=bestguesspass; compauth=pass. Content is unsolicited advertising to my mailbox. Includes List-ID and one-click List-Unsubscribe (RFC 2369), yet I have no prior relationship/opt-in. No evidence of spoofing; appears bulk marketing via an ESP. Potential violation: CAN-SPAM (15 U.S.C. §7701 et seq.) if sent without consent or ignoring opt-out; no obvious RFC 5321/5322 violations observed. Please review sender/account (Feedback-ID 53101529.8875602 / campaign 161de4c1af). Host/IP: mail117.atl31.mcdlv.net → 205.201.134.117 (Mailchimp sending node). Abuse/complaints email: [email protected]. Company phone (public): +1-800-315-5939 show less	Fraud Orders Phishing Web Spam Email Spam
🇺🇸 67.227.85.86	21 Aug 2025	Unsolicited mass-marketing email received on Aug 20, 2025 at 00:22 UTC. Subject: “Maximize Influence ... show more Unsolicited mass-marketing email received on Aug 20, 2025 at 00:22 UTC. Subject: “Maximize Influencer Microtargeting for Your Brand”. Message promotes digital marketing services and includes links and one-click unsubscribe; no prior business relationship exists with the recipient. Authentication shows infrastructure-sent mail, not spoofing: SPF=pass for digimarcon.com via 67.227.85.86 (m86.mxout.mta4.net), DKIM=pass (digimarcon.com; elasticemail.com), DMARC=pass (policy action=none). Despite passing auth, this is unwanted bulk advertising. Potential legal issues: violates anti-spam policies and may violate the U.S. CAN-SPAM Act (15 U.S.C. §7704) if sent without affirmative consent or if opt-out not honored. RFC status: no header/auth failures observed (RFC 7208, 6376, 7489). Please review and curb abusive sending from this host. show less	Fraud Orders Phishing Web Spam Email Spam
🇺🇸 66.181.33.215	21 Aug 2025	Received on Aug 21, 2025 at 12:48:55 -0400. Message claims a $750 payment and impersonates “Cash App ... show more Received on Aug 21, 2025 at 12:48:55 -0400. Message claims a $750 payment and impersonates “Cash App,” pushing the recipient to click verification links hosted behind storage.googleapis.com redirects; classic advance-to-credential-phish/spam. Connecting IP: 66.181.33.215 (ziemann.danied.net) via TLS. Auth results: SPF=pass for 1mercedes-e63s.trodedyinhave.com; DKIM=permerror (no key) for m1180m.atlq0a.a9ug9q.us; DMARC not shown and alignment appears to fail (From domain ≠ SPF domain). Headers show bulk-delivery infrastructure references (sailthru). Likely violations: CAN-SPAM (deceptive subject/sender), wire fraud 18 U.S.C. §1343, and anti-phishing/consumer-fraud statutes. RFCs implicated: 5321/5322 (misleading headers), 6376 (DKIM failure), 7489 (DMARC misalignment). IP belongs to UnReal Servers, LLC — abuse: [email protected] , phone +1-816-810-0551 show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇰🇷 27.255.77.83	21 Aug 2025	Received on Aug 21, 2025 at 12:07:56 ET. Source IP 27.255.77.83 presented as aposternal.com and sent ... show more Received on Aug 21, 2025 at 12:07:56 ET. Source IP 27.255.77.83 presented as aposternal.com and sent an unsolicited casino promo (“400% bonus up to €2000 + 145 Free Spins”) using envelope sender …@qnss.egsh.everlookingdom.net. Auth: SPF=pass; DKIM=none; DMARC=none. Gmail added a missing Message-ID (“…ADDED_MISSING”), headers misuse multipart/report for marketing, with base64-obfuscated HTML and random filler—classic bulk UCE with deceptive header tricks to evade filters. Message path shows external MTA hop references and irregular delegation header. This appears to originate from or transit via a misused/compromised host at 27.255.77.83. Please investigate, disable the sender, and remove related campaigns. Violations: CAN-SPAM (15 U.S.C. §7701 et seq.); RFC 5322 (missing/forged Message-ID); RFC 3462 (misuse of multipart/report). Network/ASN: Hostcenter (EHOSTIDC-AS-KR / AS45382). Abuse/IRT: [email protected] (APNIC/KRNIC IRT). Org contact email: [email protected] (IP Manager). show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇷🇴 194.242.46.64	21 Aug 2025	Received on Thu, 21 Aug 2025 08:49:13 PDT. Unsolicited casino promo (“Exclusive casino offer now ava ... show more Received on Thu, 21 Aug 2025 08:49:13 PDT. Unsolicited casino promo (“Exclusive casino offer now available”) with tracking pixel and links that redirect via storage.googleapis.com. Envelope MAIL FROM uses misleading subdomain [email protected] (crafted to resemble Salesforce) with SPF=pass, but visible From is “Casino.Special” [email protected] (domain mismatch). DKIM=permerror for d=q7no.w21vgfw4bx.us (no key). DMARC: result not shown; alignment fails because From domain doesn’t align with SPF and DKIM is invalid. ARC: cv=none. Likely CAN-SPAM violations (15 U.S.C. §7704) due to deceptive header/domain and absence of clear opt-out/physical address. RFC notes: DKIM failure per RFC 6376; DMARC non-alignment per RFC 7489; no obvious RFC 5322 syntax issues. Please investigate and terminate abuse on 194.242.46.64. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇳🇱 84.247.9.245	21 Aug 2025	Received Aug 21, 2025 at 11:26:34 EDT. Spam/phishing email titled “Please check your account” sent v ... show more Received Aug 21, 2025 at 11:26:34 EDT. Spam/phishing email titled “Please check your account” sent via 84.247.9.245 (boyle.himnestor.info) to Gmail. Body pushes account/balance bait (claims ~$5,000 available) and urges “verification,” with external links hosted on storage.googleapis.com plus casino/slots promos and a deceptive unsubscribe. The From field used the recipient’s name as false and Reply-To points to a different domain, while Return-Path and From are misaligned. Header auth: SPF=pass for envelope domain danciscarpend.com; DKIM=permerror (no key) for vljosqrqidmzaremkrlqalwbjj.net; DMARC not shown/appears unaligned with From. Likely violates CAN-SPAM (15 U.S.C. §7704: misleading headers/subject & nonfunctional opt-out). RFC issues: forged/invalid header chain per RFC 5321/5322; DKIM failure (RFC 6376); DMARC misalignment (RFC 7489). IP owner & complaint contacts (for 84.247.9.245):Owner/ASN: TransIP BV / Signet B.V. (AS20857). IPinfoIPIP.NETradb.netAbuse email(s): [email protected] show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host
🇺🇸 149.72.153.80	21 Aug 2025	Received on Aug 21, 2025 at 07:24:25 PDT. Unsolicited bulk advertising from “Mixedesire” sent via Sh ... show more Received on Aug 21, 2025 at 07:24:25 PDT. Unsolicited bulk advertising from “Mixedesire” sent via Shopify Email/SendGrid (o10.mailer.shopify.com; IP 149.72.153.80). Subject pushes “Hands-Free MVPs / Hot Toys / $50 or Less,” linking to a store; this is marketing, not a transactional notice. Authentication: SPF=pass, DKIM=pass (g.shopifyemail.com & sendgrid.info), DMARC=pass (from=shopifyemail.com). Headers show Precedence: bulk, Feedback-ID set, and List-Unsubscribe / One-Click present. While headers appear technically valid (no obvious RFC 5321/5322 violations), this is unsolicited commercial email; if required disclosures (e.g., physical postal address) are missing or opt-out isn’t honored, it may violate the CAN-SPAM Act (15 U.S.C. §7701 et seq.). Please investigate and take action on the sender/account. Host / IP owner (149.72.153.80): Twilio SendGrid (SendGrid, Inc.). Abuse desk: [email protected] , phone +1-888-985-7363. show less	Fraud Orders Phishing Web Spam Email Spam Spoofing Exploited Host