🇺🇸
52.101.11.9
19 Jun 2025
From: "Security|Support Message|Management|Message/20220104182931044334fadceb388a85af9bdfS06d7/1625a ...
show more
From: "Security|Support Message|Management|Message/20220104182931044334fadceb388a85af9bdfS06d7/1625a670VTBi6CQyXeyDy1wryFIMr3RzkndQNcHCwzONIhSLem ail.email.pandadoc.net/c/eJxMj8Fu2zwQhJ9GvMmguBRFHXSI80NMDkyLUVNSS04NZUAAAGVw6CR29v/pvc1904L93trBtOEtASP_BLDVCUpdT7gGMZDh16GQXhTGSDbK6XDg/rr4UBwmx.01-jagrant"@mapleleaflandscape.com <"Security|Support Message|Management|Message/20220104182931044334fadceb388a85af9bdfS06d7/1625a670VTBi6CQyXeyDy1wryFIMr3RzkndQNcHCwzONIhSLem ail.email.pandadoc.net/c/eJxMj8Fu2zwQhJ9GvMmguBRFHXSI80NMDkyLUVNSS04NZUAAAGVw6CR29v/pvc1904L93trBtOEtASP_BLDVCUpdT7gGMZDh16GQXhTGSDbK6XDg/rr4UBwmx.01-jagrant"@mapleleaflandscape.com>
Sent: Wednesday, June 18, 2025 3:32 PM
show less
Phishing
Email Spam
Spoofing
🇩🇪
82.165.159.134
19 Jun 2025
<record>
<row>
<source_ip>82.165.159.134</source_ip>
<count>12</count>
<policy_evaluated>
<disp ...
show more
<record>
<row>
<source_ip>82.165.159.134</source_ip>
<count>12</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<spf>
<domain>[redacted]</domain>
<result>fail</result>
</spf>
</auth_results>
</record>
show less
Phishing
Email Spam
Spoofing
🇩🇪
82.165.159.133
19 Jun 2025
<record>
<row>
<source_ip>82.165.159.133</source_ip>
<count>12</count>
<policy_evaluated>
<disp ...
show more
<record>
<row>
<source_ip>82.165.159.133</source_ip>
<count>12</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>[redacted]/header_from>
</identifiers>
<auth_results>
<spf>
<domain>[redacted]/</domain>
<result>fail</result>
</spf>
</auth_results>
</record>
<record>
show less
Phishing
Email Spam
Spoofing
🇩🇪
82.165.159.132
19 Jun 2025
<record>
<row>
<source_ip>82.165.159.132</source_ip>
<count>10</count>
<policy_evaluated>
<disp ...
show more
<record>
<row>
<source_ip>82.165.159.132</source_ip>
<count>10</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<spf>
<domain>[redacted]</domain>
<result>fail</result>
</spf>
</auth_results>
</record>
show less
Phishing
Email Spam
Spoofing
🇺🇸
74.208.4.197
19 Jun 2025
<record>
<row>
<source_ip>74.208.4.197</source_ip>
<count>9</count>
<policy_evaluated>
<disposi ...
show more
<record>
<row>
<source_ip>74.208.4.197</source_ip>
<count>9</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<spf>
<domain>[redacted]</domain>
<result>fail</result>
</spf>
</auth_results>
</record>
show less
Phishing
Email Spam
Spoofing
🇺🇸
74.208.4.196
19 Jun 2025
<record>
<row>
<source_ip>74.208.4.196</source_ip>
<count>9</count>
<policy_evaluated>
<disposi ...
show more
<record>
<row>
<source_ip>74.208.4.196</source_ip>
<count>9</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<spf>
<domain>[redacted]</domain>
<result>fail</result>
</spf>
</auth_results>
</record>
show less
Phishing
Email Spam
Spoofing
🇺🇸
74.208.4.194
19 Jun 2025
<feedback>
<report_metadata>
<org_name>Yahoo</org_name>
<email>[email protected] </email>
<r ...
show more
<feedback>
<report_metadata>
<org_name>Yahoo</org_name>
<email>[email protected] </email>
<report_id>1750295057.265775</report_id>
<date_range>
<begin>1750204800</begin>
<end>1750291199</end>
</date_range>
</report_metadata>
<policy_published>
<domain>[redacted]</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>reject</p>
<pct>100</pct>
</policy_published>
<record>
<row>
<source_ip>74.208.4.194</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<spf>
<domain>[redacted]</domain>
<result>fail</result>
</spf>
</auth_results>
</record>
</feedback>
show less
Phishing
Email Spam
Spoofing
🇺🇸
148.163.153.251
18 Jun 2025
DMARC with our domain redacted:
<record>
<row>
<source_ip>148.163.153.251</source_ip>
<count>3</ ...
show more
DMARC with our domain redacted:
<record>
<row>
<source_ip>148.163.153.251</source_ip>
<count>3</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<envelope_to>godaddy.com</envelope_to>
<envelope_from>[redacted]/envelope_from>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>[redacted]</domain>
<selector>selector1</selector>
<result>fail</result>
</dkim>
<spf>
<domain>[redacted]</domain>
<scope>mfrom</scope>
<result>fail</result>
</spf>
</auth_results>
</record>
<record>
show less
Email Spam
Spoofing
🇺🇸
2a01:111:f403:2417::706
18 Jun 2025
DMARC with our domain redacted:
<record>
<row>
<source_ip>2a01:111:f403:2417::706</source_ip>
<c ...
show more
DMARC with our domain redacted:
<record>
<row>
<source_ip>2a01:111:f403:2417::706</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>pass</spf>
</policy_evaluated>
</row>
<identifiers>
<envelope_to>elspearinc.com</envelope_to>
<envelope_from>[redacted]</envelope_from>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>[redacted]</domain>
<selector>selector1</selector>
<result>fail</result>
</dkim>
<spf>
<domain>[redacted]</domain>
<scope>mfrom</scope>
<result>pass</result>
</spf>
</auth_results>
</record>
<record>
show less
Email Spam
Spoofing
🇺🇸
2a01:111:f403:240a::723
18 Jun 2025
DMARC with our domain redacted:
<record>
<row>
<source_ip>2a01:111:f403:240a::723</source_ip>
<c ...
show more
DMARC with our domain redacted:
<record>
<row>
<source_ip>2a01:111:f403:240a::723</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>pass</spf>
</policy_evaluated>
</row>
<identifiers>
<envelope_to>norwoodwindows.ca</envelope_to>
<envelope_from>[redacted]</envelope_from>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>[redacted]</domain>
<selector>selector1</selector>
<result>fail</result>
</dkim>
<spf>
<domain>[redacted]</domain>
<scope>mfrom</scope>
<result>pass</result>
</spf>
</auth_results>
</record>
show less
Email Spam
Spoofing
🇨🇿
188.175.125.220
18 Jun 2025
DMARC with our domain redacted:
<record>
<row>
<source_ip>188.175.125.220</source_ip>
<count>1</ ...
show more
DMARC with our domain redacted:
<record>
<row>
<source_ip>188.175.125.220</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<envelope_to>[redacted]</envelope_to>
<envelope_from>[redacted]</envelope_from>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<spf>
<domain>[redacted]</domain>
<scope>mfrom</scope>
<result>fail</result>
</spf>
</auth_results>
</record>
<record>
show less
Email Spam
Spoofing
🇺🇸
148.163.150.39
18 Jun 2025
DMARC with our domain redacted:
<record>
<row>
<source_ip>148.163.150.39</source_ip>
<count>4</c ...
show more
DMARC with our domain redacted:
<record>
<row>
<source_ip>148.163.150.39</source_ip>
<count>4</count>
<policy_evaluated>
<disposition>reject</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<envelope_to>godaddy.com</envelope_to>
<envelope_from>[redacted]</envelope_from>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>[redacted]</domain>
<selector>selector1</selector>
<result>fail</result>
</dkim>
<spf>
<domain>[redacted]</domain>
<scope>mfrom</scope>
<result>fail</result>
</spf>
</auth_results>
</record>
show less
Email Spam
Spoofing
🇺🇸
52.100.166.223
18 Jun 2025
I'm new to this, somehow got to wear the IT hat here at work. After insane spam and fake bounce emai ...
show more
I'm new to this, somehow got to wear the IT hat here at work. After insane spam and fake bounce email, I figured out how to set spf,dkim,dmarc. Seems we still have our domain spoofed by various *.outbound.protection.outlook.com abusers. Trace on nam12-dm6-obe.outbound.protection.outlook.com hops 15 places through all sorts of sketch. Here is recent dmarc snippet with our domain redacted:
<record>
<row>
<source_ip>52.100.166.223</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>[redacted]</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>[redacted]</domain>
<result>pass</result>
<selector>selector1</selector>
</dkim>
<spf>
<domain>nam12-dm6-obe.outbound.protection.outlook.com</domain>
<result>pass</result>
</spf>
</auth_results>
</record>
show less
Spoofing