Pretending to be Halifax bank. Blacklisting. you'd think Google could control spam relaying on their ...
show morePretending to be Halifax bank. Blacklisting. you'd think Google could control spam relaying on their own network.
show less
Received: from mail-ed1-x561.google.com (mail-ed1-x561.google.com [IPv6:2a00:1450:4864:20::561])
...
show moreReceived: from mail-ed1-x561.google.com (mail-ed1-x561.google.com [IPv6:2a00:1450:4864:20::561])
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1771430353; x=1772035153;
h=content-transfer-encoding:mime-version:subject:message-id:to:from
:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
Received: from WIN-RF29DORDGT1 ([74.0.32.140])
by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-65bad19c016sm2389583a12.2.2026.02.18.07.59.13
X-Relaying-Domain: hipalanet.com
Date: Wed, 18 Feb 2026 07:59:13 -0800 (PST)
From: Halifax <[email protected]>
Message-ID: <[email protected]>
Subject: Important Information: Accept New Halifax Terms by Feb 28th
<a href=3D"https://trackingservice.monday.com/tracker/link?token=
show less
Received: from re122.myddns.me (re122.myddns.me [51.77.29.122])
DKIM-Signature: v=1; a=rsa-sha1; c= ...
show moreReceived: from re122.myddns.me (re122.myddns.me [51.77.29.122])
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=publicidadentv.com;
h=Date:To:From:Reply-To:Subject:Message-ID:List-Unsubscribe:MIME-Version:
Content-Type; [email protected];
From: 123Loterias <[email protected]>
Reply-To: [email protected]
Subject: =?UTF-8?Q?Pozo_746_Millones_USD_=C2=A1Aprovecha_un_2x1!?=
JUGA POR USD 746 MILLONES CON 1 TICKET FREE - ELEGI TUS NUMEROS
show less
phishing, poorly
Received: from lp3.hosting.link.net (lp-3.linkdatacenter.net [41.196.200.193])
Re ...
show morephishing, poorly
Received: from lp3.hosting.link.net (lp-3.linkdatacenter.net [41.196.200.193])
Received: from [45.131.60.96] (port=56771 helo=WIN-KNHEQDL8D7C)
by lp-3.linkdatacenter.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2)
(envelope-from <[email protected]>)
From: =?utf-8?B?R29vZ2xlIENsb3Vk?= <[email protected]>
Reply-To: [email protected]
then (poorly) pretending to be Google Cloud notifying (urgently) of storage exceeded and click this link to fix it.
show less
Pretending to be DHL
Received: from ecuttingboard.com (177.160.140.34.bc.googleusercontent.com [34. ...
show morePretending to be DHL
Received: from ecuttingboard.com (177.160.140.34.bc.googleusercontent.com [34.140.160.177])
Received: by ecuttingboard.com (Postfix, from userid 1000)
From: "DHL" <[email protected]>
Subject: Package status: Action required
Content-Transfer-Encoding: base64
links to https://links.truthsocial.com/link/115430921420415815
show less
Received: from smtp.pagestorylink.site (unknown [103.82.39.146])
Subject: Action Required: Your Pag ...
show moreReceived: from smtp.pagestorylink.site (unknown [103.82.39.146])
Subject: Action Required: Your Page Violates Facebook Policies
From: Meta Support <[email protected]>
Reply-To: Meta Support <[email protected]>
=09=09Submit Appe=
al [https://fb-setting-verificatio.netlify.app/live]
show less
Received: from mail.esaddereims.fr (esaddereims.fr [62.8.10.150])
Subject: Contact us now to claim
...
show moreReceived: from mail.esaddereims.fr (esaddereims.fr [62.8.10.150])
Subject: Contact us now to claim
To: Recipients <[email protected]>
From: "Georg F. Wilhelm" <[email protected]>
Date: Wed, 31 Dec 2025 16:27:26 +0000
Reply-To: [email protected]
The Schaeffler Group company is offering an investment and business fund worth amount of โฌ1,700,000.00 euro to individuals and companies and we are delighted to contact you to receive the fund to invest or for business purpose.If you are interested in my investment fund, contact us now to claim. This fund is also to assist you and help the people in need of support.
show less
referred inside phishing spam
Your recent payment attempt to renew your extended device
protecti ...
show morereferred inside phishing spam
Your recent payment attempt to renew your extended device
protection subscription was unsuccessful.
Your protection plan has already expired. Without active
security, your device is now exposed to serious cyber threats.
=F0=9F=94=92 Renew Protection Now ( https://ast.thuenhahoitui.info/ga/click=
/2-3537514-32-5647-11149-8407-d5fcd3c251-8a8e90ff46 )
=C2=A9 2025 McAfee. All rights reserved.
Unsubscribe ( https://ast.thuenhahoitui.info/ga/unsubscribe/2-3537514-32-56=
47-11149-b71cace0fa63af4-8a8e90ff46 )=
show less
Received: from fricker-smtp8.aclearplace.ch (fricker-smtp8.aclearplace.ch [212.83.166.184])
Subject ...
show moreReceived: from fricker-smtp8.aclearplace.ch (fricker-smtp8.aclearplace.ch [212.83.166.184])
Subject: Security warning! Your device is currently not secured!
From: "Olivia / McAfee Customer Support" <[email protected]>
List-Unsubscribe: <https://ast.thuenhahoitui.info/ga/unsubscribe/2-3537514-32-5647-11149-b71cace0fa63af4-8a8e90ff46?confirmed=1>,
<mailto:[email protected]>
=F0=9F=94=92 Renew Protection Now ( https://ast.thuenhahoitui.info/ga/click=
/2-3537514-32-5647-11149-8407-d5fcd3c251-8a8e90ff46 )
Unsubscribe ( https://ast.thuenhahoitui.info/ga/unsubscribe/2-3537514-32-56=
47-11149-b71cace0fa63af4-8a8e90ff46 )=
show less
Return-Path: <[email protected]>
Received: from mailwsout-c783.transactional-mail-a.co ...
show moreReturn-Path: <[email protected]>
Received: from mailwsout-c783.transactional-mail-a.com (mailwsout-c783.transactional-mail-a.com [185.215.216.106])
Received: from mailwsout16.mailws.fraix1.retloc (localhost [127.0.0.1])
by mailwsout16.transactional-mail-a.com (Postfix) with ESMTP id 4dYxV34hrmz11HK
Subject: =?UTF-8?Q?Consigue_tu_Welcome_Pack_exclusivo_de_Aena_Club=E2=80=A6?=
List-Unsubscribe: <https://eu.email.sdi.sinch.com/v1/unsubscribe/NEMzMzIzMEFGNzUzMUJGQnwzNjM2OHxoeWJyaXNfYWVuNDYxNjR8ME0yUUVER3wwMDAwMDAxNjQ5fHByb21vY2lvbmNvbWVyY2lhbEBhZW5hLm9ubGluZXwxNzY2MzEwODg5NjE4fHBhdWxAaGFycmltYW40LmNvbQ==&>,<mailto:[email protected]?subject=NEMzMzIzMEFGNzUzMUJGQnwzNjM2OHxoeWJyaXNfYWVuNDYxNjR8ME0yUUVER3wwMDAwMDAxNjQ5fHByb21vY2lvbmNvbWVyY2lhbEBhZW5hLm9ubGluZXwxNzY2MzEwODg5NjE4&>
Feedback-ID: 0000001649:[email protected]:0M2QEDG:36368
show less
Received: from a48-93.smtp-out.amazonses.com (a48-93.smtp-out.amazonses.com [54.240.48.93])
VERIFY ...
show moreReceived: from a48-93.smtp-out.amazonses.com (a48-93.smtp-out.amazonses.com [54.240.48.93])
VERIFY YOUR IDENTITY
For security purposes, we need to confirm your=
identity and verify recent
account activity. Please review the details =
inside to ensure your account
remains secure and protected.
[https://a7a7a7.shop/wp-json/wemail/v1/track/93862500-0cf6-4557-=
9a5a-6582310a2a7b:e0596c925d16e9757993525b9efcd7f7/24ce2757d39db30e24b75eed=
04e914ab?email_id=3D21f78b65-068e-4ae3-b3d5-ea504160a3b1]
show less
more xorek spam. Pretending to be from Premier Inn.
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/re ...
show moremore xorek spam. Pretending to be from Premier Inn.
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=linkvaodafabet.com;
h=MIME-version:Content-type:To:From:Subject:Date:Sender:Message-ID:List-Unsubscribe; [email protected];
From: Premier Inn <[email protected]>
Subject: Re: Congratulations!,paulรฐยยย
Date: Sat, 29 Nov 2025 04:47:07 +0000
X-Priority: 1 (Highest)
X-MSMail-Priority: High
Importance: High
Sender: <[email protected]>
<a href="http://new1126.dream.org.il/4/55646/827/6064/163410/12584/9/l34fuxl89i" class="button">Claim your gift</a>
show less
Received: from smtp.fedex-vip.cn (unknown [45.116.79.58])
Reply-To: <[email protected]>
Date: T ...
show moreReceived: from smtp.fedex-vip.cn (unknown [45.116.79.58])
Reply-To: <[email protected]>
Date: Tue, 18 Nov 2025 18:55:46 +0800
From: "DHL" <[email protected]>
Received: from yahoo2.com.cn (119.123.171.56) by smtp.fedex-vip.cn id h3h8au0e97cj
Subject: =?utf-8?B?5Zu96ZmF5b+r6YCS5qyn5rSy576O5Zu954m55Lu35biC5Zy65pyA5L2O77yM5qyn5rSy6aaW6YeNMA==?=
=?utf-8?B?LjVLRyA1OeWFg++8jOe7remHjTMwIC/nvo7lm70xMTk=?=
=?utf-8?B?LzMw77yM5YyF56iO5Y+M5riFRERQ5ZCr54eD5rK55Y+K5pe65a2j6ZmE5Yqg6LS5?=
=?utf-8?B?77yb6ZmQ5pe25pyq6L6+5YWN6L+Q6LS577yb5Y+v5o6l5aSa56eN5Lqn5ZOB77yM5pyN5Yqh5pyJ5L+d?=
=?utf-8?B?6Zqc?=
followed by Chinese fake invoice etc.
show less
Received: from super-silver.shop (super-silver.shop [78.111.67.196])
Received: from [138.199.15.175 ...
show moreReceived: from super-silver.shop (super-silver.shop [78.111.67.196])
Received: from [138.199.15.175] (helo=[10.139.226.190])
by cp.super-silver.shop with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Subject: Your Premium Access is Ending Soon
From: Spotify <[email protected]>
(Exim 4.94.2)
(envelope-from <[email protected]>)
<img src="https://i.imgur.com/4wvo6Am.png" alt="Spotify Logo" class="spotify-logo">
<h2>Your Premium Access is Ending Soon</h2>
<p>We're reminding you that your Premium subscription concludes on 2025-11-14.</p>
<p>you'll soon experience ads, lose downloaded playlists, and face playback restrictions.</p>
<p>Continue enjoying Spotify without limitations by renewing your membership now.</p>
<a href="https://turnwife.space/TurnWife" class="spotify-button">STAY PREMIUM</a>
show less
Xorek phishing again... IBKR fake tax form
Received: from mail.hlxjwg.com (unknown [77.239.109.170 ...
show moreXorek phishing again... IBKR fake tax form
Received: from mail.hlxjwg.com (unknown [77.239.109.170])
DKIM-Signature: v=1; a=rsa-sha256; d=hlxjwg.com; s=dkim; c=relaxed/relaxed;
bh=PdnhsJW+fC2TbNHkhu2ia4hhfPP2B8vdBP8V6YxYL24=;
h=from:to:subject:date:message-id:sender; t=1760539569;
From: Interactive Brokers <[email protected]>
Subject: Update Required for IRS Tax Reporting =?utf-8?b?4oCU?= Renew W-8BEN
The renewal process is secure and can be completed online in just a few min=
utes:<br /><br />
<a href=3D"https://ulszxfrip.com?token=3DIVV9t3PPOvRkpPg4xzeK">Renew W-8BEN=
Form</a><br /><br />
show less
Received: from out-1.mail.amis.net (out-1.mail.amis.net [212.18.32.4])
Received: from in-2.mail.ami ...
show moreReceived: from out-1.mail.amis.net (out-1.mail.amis.net [212.18.32.4])
Received: from in-2.mail.amis.net (in-2.mail.amis.net [212.18.32.19])
Received: from smtp1.amis.net (smtp1.amis.net [212.18.32.41])
Subject: Please Review and Confirm Your Details
To: Recipients <[email protected]>
From: "Wise Customer Care" <[email protected]>
href=3D"https://pcdoktor2009=
.lima-city.de/doc/--"
show less
phishing sumup mail webmail.workd.go.th (49.229.91.134)
ARC-Authentication-Results: i=1; mx.microso ...
show morephishing sumup mail webmail.workd.go.th (49.229.91.134)
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=permerror (sender ip
is 49.229.91.134) smtp.rcpttodomain=harriman4.net smtp.mailfrom=drt.go.th;
dmarc=none action=none header.from=drt.go.th; dkim=none (message not signed);
arc=none (0)
X-MS-Exchange-Authentication-Results: spf=permerror (sender IP is
49.229.91.134) smtp.mailfrom=drt.go.th; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=drt.go.th;
Received-SPF: PermError (protection.outlook.com: domain of drt.go.th used an
invalid SPF mechanism)
Received: from webmail.workd.go.th (49.229.91.134) by TY2PEPF0000AB89.mail.protection.outlook.com (10.167.253.7) with Microsoft
SMTP Server
From: SumUp Verification Centre <[email protected]>
Subject: Important: Complete your account verification to keep receiving
payments
show less
PhishingEmail Spam
By clicking โAccept allโ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.