Received: from mail.esaddereims.fr (esaddereims.fr [62.8.10.150])
Subject: Contact us now to claim
...
show moreReceived: from mail.esaddereims.fr (esaddereims.fr [62.8.10.150])
Subject: Contact us now to claim
To: Recipients <[email protected]>
From: "Georg F. Wilhelm" <[email protected]>
Date: Wed, 31 Dec 2025 16:27:26 +0000
Reply-To: [email protected]
The Schaeffler Group company is offering an investment and business fund worth amount of โฌ1,700,000.00 euro to individuals and companies and we are delighted to contact you to receive the fund to invest or for business purpose.If you are interested in my investment fund, contact us now to claim. This fund is also to assist you and help the people in need of support.
show less
referred inside phishing spam
Your recent payment attempt to renew your extended device
protecti ...
show morereferred inside phishing spam
Your recent payment attempt to renew your extended device
protection subscription was unsuccessful.
Your protection plan has already expired. Without active
security, your device is now exposed to serious cyber threats.
=F0=9F=94=92 Renew Protection Now ( https://ast.thuenhahoitui.info/ga/click=
/2-3537514-32-5647-11149-8407-d5fcd3c251-8a8e90ff46 )
=C2=A9 2025 McAfee. All rights reserved.
Unsubscribe ( https://ast.thuenhahoitui.info/ga/unsubscribe/2-3537514-32-56=
47-11149-b71cace0fa63af4-8a8e90ff46 )=
show less
Received: from fricker-smtp8.aclearplace.ch (fricker-smtp8.aclearplace.ch [212.83.166.184])
Subject ...
show moreReceived: from fricker-smtp8.aclearplace.ch (fricker-smtp8.aclearplace.ch [212.83.166.184])
Subject: Security warning! Your device is currently not secured!
From: "Olivia / McAfee Customer Support" <[email protected]>
List-Unsubscribe: <https://ast.thuenhahoitui.info/ga/unsubscribe/2-3537514-32-5647-11149-b71cace0fa63af4-8a8e90ff46?confirmed=1>,
<mailto:[email protected]>
=F0=9F=94=92 Renew Protection Now ( https://ast.thuenhahoitui.info/ga/click=
/2-3537514-32-5647-11149-8407-d5fcd3c251-8a8e90ff46 )
Unsubscribe ( https://ast.thuenhahoitui.info/ga/unsubscribe/2-3537514-32-56=
47-11149-b71cace0fa63af4-8a8e90ff46 )=
show less
Return-Path: <[email protected]>
Received: from mailwsout-c783.transactional-mail-a.co ...
show moreReturn-Path: <[email protected]>
Received: from mailwsout-c783.transactional-mail-a.com (mailwsout-c783.transactional-mail-a.com [185.215.216.106])
Received: from mailwsout16.mailws.fraix1.retloc (localhost [127.0.0.1])
by mailwsout16.transactional-mail-a.com (Postfix) with ESMTP id 4dYxV34hrmz11HK
Subject: =?UTF-8?Q?Consigue_tu_Welcome_Pack_exclusivo_de_Aena_Club=E2=80=A6?=
List-Unsubscribe: <https://eu.email.sdi.sinch.com/v1/unsubscribe/NEMzMzIzMEFGNzUzMUJGQnwzNjM2OHxoeWJyaXNfYWVuNDYxNjR8ME0yUUVER3wwMDAwMDAxNjQ5fHByb21vY2lvbmNvbWVyY2lhbEBhZW5hLm9ubGluZXwxNzY2MzEwODg5NjE4fHBhdWxAaGFycmltYW40LmNvbQ==&>,<mailto:[email protected]?subject=NEMzMzIzMEFGNzUzMUJGQnwzNjM2OHxoeWJyaXNfYWVuNDYxNjR8ME0yUUVER3wwMDAwMDAxNjQ5fHByb21vY2lvbmNvbWVyY2lhbEBhZW5hLm9ubGluZXwxNzY2MzEwODg5NjE4&>
Feedback-ID: 0000001649:[email protected]:0M2QEDG:36368
show less
Received: from a48-93.smtp-out.amazonses.com (a48-93.smtp-out.amazonses.com [54.240.48.93])
VERIFY ...
show moreReceived: from a48-93.smtp-out.amazonses.com (a48-93.smtp-out.amazonses.com [54.240.48.93])
VERIFY YOUR IDENTITY
For security purposes, we need to confirm your=
identity and verify recent
account activity. Please review the details =
inside to ensure your account
remains secure and protected.
[https://a7a7a7.shop/wp-json/wemail/v1/track/93862500-0cf6-4557-=
9a5a-6582310a2a7b:e0596c925d16e9757993525b9efcd7f7/24ce2757d39db30e24b75eed=
04e914ab?email_id=3D21f78b65-068e-4ae3-b3d5-ea504160a3b1]
show less
more xorek spam. Pretending to be from Premier Inn.
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/re ...
show moremore xorek spam. Pretending to be from Premier Inn.
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=linkvaodafabet.com;
h=MIME-version:Content-type:To:From:Subject:Date:Sender:Message-ID:List-Unsubscribe; [email protected];
From: Premier Inn <[email protected]>
Subject: Re: Congratulations!,paulรฐยยย
Date: Sat, 29 Nov 2025 04:47:07 +0000
X-Priority: 1 (Highest)
X-MSMail-Priority: High
Importance: High
Sender: <[email protected]>
<a href="http://new1126.dream.org.il/4/55646/827/6064/163410/12584/9/l34fuxl89i" class="button">Claim your gift</a>
show less
Received: from smtp.fedex-vip.cn (unknown [45.116.79.58])
Reply-To: <[email protected]>
Date: T ...
show moreReceived: from smtp.fedex-vip.cn (unknown [45.116.79.58])
Reply-To: <[email protected]>
Date: Tue, 18 Nov 2025 18:55:46 +0800
From: "DHL" <[email protected]>
Received: from yahoo2.com.cn (119.123.171.56) by smtp.fedex-vip.cn id h3h8au0e97cj
Subject: =?utf-8?B?5Zu96ZmF5b+r6YCS5qyn5rSy576O5Zu954m55Lu35biC5Zy65pyA5L2O77yM5qyn5rSy6aaW6YeNMA==?=
=?utf-8?B?LjVLRyA1OeWFg++8jOe7remHjTMwIC/nvo7lm70xMTk=?=
=?utf-8?B?LzMw77yM5YyF56iO5Y+M5riFRERQ5ZCr54eD5rK55Y+K5pe65a2j6ZmE5Yqg6LS5?=
=?utf-8?B?77yb6ZmQ5pe25pyq6L6+5YWN6L+Q6LS577yb5Y+v5o6l5aSa56eN5Lqn5ZOB77yM5pyN5Yqh5pyJ5L+d?=
=?utf-8?B?6Zqc?=
followed by Chinese fake invoice etc.
show less
Received: from super-silver.shop (super-silver.shop [78.111.67.196])
Received: from [138.199.15.175 ...
show moreReceived: from super-silver.shop (super-silver.shop [78.111.67.196])
Received: from [138.199.15.175] (helo=[10.139.226.190])
by cp.super-silver.shop with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Subject: Your Premium Access is Ending Soon
From: Spotify <[email protected]>
(Exim 4.94.2)
(envelope-from <[email protected]>)
<img src="https://i.imgur.com/4wvo6Am.png" alt="Spotify Logo" class="spotify-logo">
<h2>Your Premium Access is Ending Soon</h2>
<p>We're reminding you that your Premium subscription concludes on 2025-11-14.</p>
<p>you'll soon experience ads, lose downloaded playlists, and face playback restrictions.</p>
<p>Continue enjoying Spotify without limitations by renewing your membership now.</p>
<a href="https://turnwife.space/TurnWife" class="spotify-button">STAY PREMIUM</a>
show less
Xorek phishing again... IBKR fake tax form
Received: from mail.hlxjwg.com (unknown [77.239.109.170 ...
show moreXorek phishing again... IBKR fake tax form
Received: from mail.hlxjwg.com (unknown [77.239.109.170])
DKIM-Signature: v=1; a=rsa-sha256; d=hlxjwg.com; s=dkim; c=relaxed/relaxed;
bh=PdnhsJW+fC2TbNHkhu2ia4hhfPP2B8vdBP8V6YxYL24=;
h=from:to:subject:date:message-id:sender; t=1760539569;
From: Interactive Brokers <[email protected]>
Subject: Update Required for IRS Tax Reporting =?utf-8?b?4oCU?= Renew W-8BEN
The renewal process is secure and can be completed online in just a few min=
utes:<br /><br />
<a href=3D"https://ulszxfrip.com?token=3DIVV9t3PPOvRkpPg4xzeK">Renew W-8BEN=
Form</a><br /><br />
show less
Received: from out-1.mail.amis.net (out-1.mail.amis.net [212.18.32.4])
Received: from in-2.mail.ami ...
show moreReceived: from out-1.mail.amis.net (out-1.mail.amis.net [212.18.32.4])
Received: from in-2.mail.amis.net (in-2.mail.amis.net [212.18.32.19])
Received: from smtp1.amis.net (smtp1.amis.net [212.18.32.41])
Subject: Please Review and Confirm Your Details
To: Recipients <[email protected]>
From: "Wise Customer Care" <[email protected]>
href=3D"https://pcdoktor2009=
.lima-city.de/doc/--"
show less
phishing sumup mail webmail.workd.go.th (49.229.91.134)
ARC-Authentication-Results: i=1; mx.microso ...
show morephishing sumup mail webmail.workd.go.th (49.229.91.134)
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=permerror (sender ip
is 49.229.91.134) smtp.rcpttodomain=harriman4.net smtp.mailfrom=drt.go.th;
dmarc=none action=none header.from=drt.go.th; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=permerror (sender IP is
49.229.91.134) smtp.mailfrom=drt.go.th; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=drt.go.th;
Received-SPF: PermError (protection.outlook.com: domain of drt.go.th used an
invalid SPF mechanism)
Received: from webmail.workd.go.th (49.229.91.134) by TY2PEPF0000AB89.mail.protection.outlook.com (10.167.253.7) with Microsoft
SMTP Server
From: SumUp Verification Centre <[email protected]>
Subject: Important: Complete your account verification to keep receiving
payments
show less
classic spam/scam
"If yes then send the executive summary and the financial projections to my ...
show moreclassic spam/scam
"If yes then send the executive summary and the financial projections to my Boss Aloke Lohia, CEO of Indorama Ventures PCL through via email "
Return-Path: <[email protected]>
dkim=pass (2048-bit key) header.d=bellafique.com;
domainkeys=pass (2048-bit key) [email protected]
header.d=bellafique.com
Subject: Project Funding
show less
Received: from skot-sift.com (skot-sift.com [5.255.121.27])
DKIM-Signature: v=1; a=rsa-sha256; q=dn ...
show moreReceived: from skot-sift.com (skot-sift.com [5.255.121.27])
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=skot-sift.com; s=mail; h=Date:Message-Id:Reply-To:To:From:Subject:
Subject: Your Premium Access is Ending Soon
From: Spotify <[email protected]>
<img src="https://i.imgur.com/4wvo6Am.png" alt="Spotify Logo" class="spotify-logo">
<h2>Your Premium Access is Ending Soon</h2>
<p>We're reminding you that your Premium subscription concludes on 2025-09-21.</p>
<p>you'll soon experience ads, lose downloaded playlists, and face playback restrictions.</p>
<p>Continue enjoying Spotify without limitations by renewing your membership now.</p>
<a href="https://tunehave.space/TuneHave/" class="spotify-button">STAY PREMIUM</a>
show less
part of a relay chain apparently for spamming.
Received: from [146.70.144.59] (helo=[10.149.241.185 ...
show morepart of a relay chain apparently for spamming.
Received: from [146.70.144.59] (helo=[10.149.241.185])
by cp.skot-sift.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.94.2)
(envelope-from <[email protected]>)
show less
Xorek again
Received: from amitda.com (unknown [94.141.160.164])
reason="invalid (public key: not ...
show moreXorek again
Received: from amitda.com (unknown [94.141.160.164])
reason="invalid (public key: not available)" header.d=amitda.com
h=Content-Type:MIME-Version:From:Subject:To:Message-ID:Date;
[email protected];
From: =?UTF-8?B?TWNBZmVl4oSi?= <[email protected]>
Subject: Re: =?UTF-8?B?U2VjdXJpdHkgV2FybmluZzogVGhlIGRldmljZSBpcyBmdWxsIG9mIHZpcnVzZXMgIQ==?=
Re: Security Warning: The device is full of viruses !
Your McAfee subscription may end today
show less
Google sending spam? who knew.
Received: from 142.63.140.34.bc.googleusercontent.com (HELO [10.88.0 ...
show moreGoogle sending spam? who knew.
Received: from 142.63.140.34.bc.googleusercontent.com (HELO [10.88.0.8]) ([34.140.63.142]) by mx684.mel.oss-core.net with ESMTP; 05 Nov 2024 08:33:38 +1100
reason="invalid (public key: not available)" header.d=amitda.com
Received: from amitda.com (unknown [94.141.160.164])
Message-ID: <[email protected]>
LAST REMINDER: CONFIRMATION NEEDED
Your McAfee subscription may end today
After the expiration date, your devices will be vulnerable to hackers.
show less
Received: from nts.powercomponents-nl.com (unknown [31.192.236.38])
Reply-To: Abdullah Hamza Muhamm ...
show moreReceived: from nts.powercomponents-nl.com (unknown [31.192.236.38])
Reply-To: Abdullah Hamza Muhammad <[email protected]>
From: Abdullah Hamza Muhammad <[email protected]>
Subject: Business Cooperative Initiative
dkim=pass (2048-bit key) header.d=powercomponents-nl.com
show less
dkim=fail (2048-bit key) reason="fail (body has been altered)"
header.d=thriveloop.space; domainke ...
show moredkim=fail (2048-bit key) reason="fail (body has been altered)"
header.d=thriveloop.space; domainkeys=fail (2048-bit key)
reason="fail (message has been altered)"
[email protected]
header.d=thriveloop.space
Received: from quebec.thriveloop.space (unknown [176.65.150.98])
From: "Do Not Drink Coffee" <[email protected]>
Reply-To: "Do Not Drink Coffee" <[email protected]>
Subject: Are You Eating This Everyday Food That Affects Your Nerves?
show less
Email Spam
By clicking โAccept allโ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.