IP used to send unsolicited bulk email (spam) advertising "Magic Seven" email blasting corbett softw ...
show moreIP used to send unsolicited bulk email (spam) advertising "Magic Seven" email blasting corbett software. Sent via mail.atlas-groupe.net, SPF softfail, DKIM none, DMARC fail. Reply-To points to Brazilian domain [email protected]. Message-ID missing. Date: 2026-06-17.
show less
Phishing campaign impersonating Publicis Groupe (publicisgroupe.com) for fake recruitment. Sent via ...
show morePhishing campaign impersonating Publicis Groupe (publicisgroupe.com) for fake recruitment. Sent via Zoho Desk / ZeptoMail. Fraudulent domain: publicisgroupejoin.com (registered 2026-05-13). Zoho org ID: 926529353, Desk ticket: 1367867000005002221. From: [email protected]. DMARC FAIL on header.from=publicisgroupejoin.com. Same infrastructure also impersonates Omnicom Group (org slug: recruitmentomnicomgroup).
show less
IP used as SMTP relay (AWS EC2, ec2-34-205-39-3.compute-1.amazonaws.com) for unsolicited B2B cold ou ...
show moreIP used as SMTP relay (AWS EC2, ec2-34-205-39-3.compute-1.amazonaws.com) for unsolicited B2B cold outreach emails sent via the Instantly.ai platform. Sender: [email protected] (burner domain, configured as HTTP 307/301 redirect to salescloser.ai, an AI sales agent SaaS product). SMTP headers consistent with a mass automated marketing campaign (X-Mail-Abuse-Inquiries points to app.instantly.ai/privacy/report-abuse). Content: commercial pitch for AI-based client management/appointment scheduling targeted at photographers. No malware or malicious links in the body, but pattern typical of unsolicited spam/cold-email using a disposable sender domain solely for delivery.
show less
Subject "Gold in Focus โ CTO.ASX (GitiGold)" stock-spam/pump-and-dump campaign. Sender IP 38.48.123. ...
show moreSubject "Gold in Focus โ CTO.ASX (GitiGold)" stock-spam/pump-and-dump campaign. Sender IP 38.48.123.79 (Cogent Communications, AS212238, London UK datacenter), HELO smtp.drp-iva.com.hk, envelope-from [email protected] (domain drp-iva.com.hk). Email passes SPF for that domain but DKIM=none/DMARC=none. Relayed through defox.mhost-cp.com (5.9.80.122). Body links to a Facebook group (facebook.com/groups/ctoasxgoldminingcharterstowers) acting as fake "document pack", uses fake personas "Victoria Hayes"/"Silvio Morgan" from "Precious Metals and Miners Australia", and solicits replies for "investment" categories (A-E) including mortgage/private credit offers โ classic boiler-room/financial scam tactics targeting ASX-listed gold stock CTO.ASX. Recommend flagging IP and domain drp-iva.com.hk for spam/scam category.
show less
Received spam/scam email (advance fee fraud - fake investment partnership offer) from this IP via ta ...
show moreReceived spam/scam email (advance fee fraud - fake investment partnership offer) from this IP via taurus.narae.com (Korea Telecom, AS4766). SPF check resulted in softfail ([email protected] not authorized by this IP/host), and DKIM/DMARC are absent, suggesting a compromised or misconfigured mail server being used for unauthorized relay. Subject: "Global Investment Expansion Offer - Strategic Business Partnerships", Reply-To: [email protected]. Message-ID: [email protected]show less
Spam/Phishing campaign: Loan scam impersonating "MoneyTree Finance Limited UK". Email sent from comp ...
show moreSpam/Phishing campaign: Loan scam impersonating "MoneyTree Finance Limited UK". Email sent from compromised account on domain ponpesgo.id (IP 112.78.33.210). Subject: "Cerchi un partner finanziario affidabile...". Content offers fake loans at 1.2% and directs victims to contact external email [email protected] or WhatsApp +447417492821. Headers confirm origin from gudeg.seminardesa.com (112.78.33.210). DKIM/SPF passed, indicating credential compromise of the legitimate Indonesian business site ("Klinik Usaha Pesantren"). Urgent suspension required.
show less
This IP (158.94.211.222, AS202412, Omegatech LTD, NL) was used as the
outbound SMTP sender for a W ...
show moreThis IP (158.94.211.222, AS202412, Omegatech LTD, NL) was used as the
outbound SMTP sender for a WeTransfer phishing campaign targeting
a redacted recipient on June 11, 2026 at 05:12 UTC.
The email impersonated WeTransfer using the fraudulent domain
omc-lu.com (registered June 10, 2026 - PDR/PublicDomainRegistry),
with envelope-from: [email protected]
The phishing link embedded in the email directed victims to:
hxxps://symplist-cosmo-x1nya74d55[.]hexconltd[.]workers[.]dev/38d55x1nya93
Confirmed malicious by:
- Google Safe Browsing: Malicious
- VirusTotal: 7/92 (BitDefender, ESET, G-Data, Fortinet, Emsisoft, Netcraft, Webroot)
- URLScan.io scan ID: 019eb5c8-80f9-774f-b117-26b79ee39585
show less
Spam campaign originating from this IP. Sending domain: grunsgreen.shop (MX: mail.grunsgreen.shop, h ...
show moreSpam campaign originating from this IP. Sending domain: grunsgreen.shop (MX: mail.grunsgreen.shop, hostname cupid.grunsgreen.shop). DKIM/SPF/DMARC all pass on attacker-owned domain. Envelope-From pattern: [email protected]. Email promotes fraudulent anti-aging skincare product ("Dr. Ryan Shelton / Clinical Skin Solutions") with deceptive medical claims. All links redirect through opaque Base64 tokens on grunsgreen.shop. Receiving MTA flagged X-Recommended-Action: reject. Categories: spam, fraudulent content.
show less
IP associated with fraudulent domain ix-quant.com (registrar: Alibaba Cloud / HiChina,
AS24138 CTT ...
show moreIP associated with fraudulent domain ix-quant.com (registrar: Alibaba Cloud / HiChina,
AS24138 CTTNET Beijing). Domain used as throwaway envelope-from in a 419 advance-fee
fraud campaign (sender: [email protected], Reply-To pivoted to Gmail). This IP is the
domain's authoritative hosting IP per whois records; SMTP delivery was performed from
sibling IP 222.35.7.123 (same /16 subnet, same ASN). Domain status: no active website โ
registered solely for abuse. SPF softfail, DKIM none, DMARC none. Date header forged
~2 months in the past. Abuse report filed with registrar. Detected: 2026-05-31 UTC.
show less
Spam origin IP for advance-fee fraud campaign (dying patient / doctor scam, "419" variant). Mail cha ...
show moreSpam origin IP for advance-fee fraud campaign (dying patient / doctor scam, "419" variant). Mail chain: mailbox.mynixhosting.com โ xnode1.redskybd.com (this IP) โ destination MX. Envelope-from: [email protected] (throwaway domain, DKIM/SPF/DMARC all pass โ not spoofing, purpose-registered). Reply-To redirects to outlook.com freemail to evade domain blocks. X-Recommended-Action: reject already set by local amavis. Authenticated sender at origin, bulk undisclosed-recipients. ASN AS38256 / Bengal Group BD. Message-ID: [email protected]show less
Phishing email impersonating Capital One (brand spoofing).
Sender IP: 186.225.17.233 (AS262760, Cen ...
show morePhishing email impersonating Capital One (brand spoofing).
Sender IP: 186.225.17.233 (AS262760, Centro Diagnรณstico Santa Marta Ltda, Sรฃo Paulo, BR)
Envelope-From: [email protected]
Date: 2026-05-28 13:48:50 UTC
Authentication failures:
DKIM: none
SPF: softfail โ capital.net has a valid SPF record (v=spf1 include:spf.protection.outlook.com ~all) but sending IP is unauthorized. Domain is spoofed; policy ~all instead of -all allows softfail through permissive MTAs.
DMARC: permerror ("Multiple policies defined in DNS")
X-Recommended-Action: reject (set by receiving MTA)
Malicious payload URL (credential harvesting, all links):
https[:]//intcredit[.]es/cap/[.]data.htm
Email uses Capital One branding to trick recipient into confirming/denying a fake $1,280 APPLAPPLE transaction, harvesting credentials via the above URL.
Legitimate Capital One domain: notification.capitalone.com
capital.net is unrelated to Capital One.
show less
Relay node used to forward unsolicited commercial email (spam) originating from a compromised WordPr ...
show moreRelay node used to forward unsolicited commercial email (spam) originating from a compromised WordPress installation.
Relay IP: 23.83.218.246 (siberian.tulip.relay.mailchannels.net, AS63213 MailChannels Corporation, Vancouver CA)
Actual origin: 216.246.46.82 (bh8936.banahosting.com, AS23352 DEFT.COM, Chicago IL)
Envelope-From: [email protected] (randomized address)
From (visible): [email protected]
Spam was injected at origin via a rogue PHP script on a hacked WordPress site (fragrosa.com), then relayed through MailChannels to destination. DKIM passed on fragrosa.com. SPF absent on sending domain (bh8936.banahosting.com).
Message promotes a fraudulent automated trading platform (kolvestium.com).
Received: 2026-05-28 11:51:24 UTC. Categories: spam, compromised host.
show less
Unsolicited commercial email (spam) sent via compromised WordPress installation.
Origin: 216.246. ...
show moreUnsolicited commercial email (spam) sent via compromised WordPress installation.
Origin: 216.246.46.82 (bh8936.banahosting.com, AS23352 DEFT.COM, Chicago IL)
Relay: MailChannels (23.83.218.246, siberian.tulip.relay.mailchannels.net)
Envelope-From: [email protected] (randomized address)
From (visible): [email protected]
DKIM passed on fragrosa.com โ mail was injected via a PHP script on a compromised WordPress site: fragrosa.com/RICHIGER-EA910/wp-content/plugins/contact_1778859541/custom_file_3_1778859541.php
X-PHP-Originating-Script header confirms automated bulk sending from hacked WP plugin. SPF record absent for sending domain. Message promotes a fraudulent automated trading platform (kolvestium.com).
Received: 2026-05-28 11:51 UTC. Categories: spam, compromised host.
show less
Unsolicited commercial email (spam) sent via a Google Workspace account without any opt-in, consent, ...
show moreUnsolicited commercial email (spam) sent via a Google Workspace account without any opt-in, consent, or unsubscribe mechanism, in violation of Gmail Program Policies and GDPR.
Sender: [email protected]
Google SMTP relay: mail-dl1-x122c.google.com (2607:f8b0:4864:20::122c)
Message-ID: CAHtBtyLD7K8scjD8N6MxgF6qoRrDgSkz=QtD1AJMEvokAv+fWA@mail.gmail.com
Date: Wed, 27 May 2026 16:25:21 +0200
DKIM: pass (d=hrdonline.it, s=google)
The email was sent as a mass BCC mailing (up to 500 recipients per Gmail's own limit) promoting a paid coaching program (Roberto Re Academy / store.robertore.com) using affiliate tracking UTM parameters attributable to "LuciaLemmetti".
Key policy violations:
- No unsubscribe link or opt-out mechanism of any kind
- No indication of how the recipient's address was obtained
- Use of BCC mass sending to obscure the recipient list
- Sending to addresses without prior consent
show less
Phishing email impersonating Microsoft SharePoint/OneDrive notification.
This IP (HostPapa/ColoCros ...
show morePhishing email impersonating Microsoft SharePoint/OneDrive notification.
This IP (HostPapa/ColoCrossing AS36352) authenticated against Google Workspace
SMTP Relay (smtp-relay.gmail.com) using domain baeza.name to deliver an OAuth
phishing attack harvesting Microsoft Graph tokens via a rogue Azure AD app
(client_id: d703410f-2775-43c9-a027-e73a7f58e848).
Target address was Base64-encoded in OAuth state parameter (targeted attack).
From: [email protected]
Message-ID: f82373c8-b438-1147-b69e-e3204e47a1bb
Date: 2026-05-26
show less
IP used to send a DocuSign-branded phishing email. The message impersonates DocuSign Electronic Sign ...
show moreIP used to send a DocuSign-branded phishing email. The message impersonates DocuSign Electronic Signature Service with a fake "Vendor Approval / PO extension" lure. Sending domain: a5-send.asia (hostname resolves directly to this IP). Hosted on AS215761 - Hosting Turkiye Internet Hizmetleri, Arnavutkoy, Istanbul, TR. The email body contains a fraudulent CTA button linking to storages.colocation.vu/[email protected] (credential harvesting page). SPF/DKIM/DMARC all pass on the purpose-built phishing domain, indicating deliberate infrastructure setup to bypass spam filters. Date: 2026-05-27 06:11 UTC.
show less
Confirmed spam campaign originating from this IP. The server hosted multiple unsolicited emails prom ...
show moreConfirmed spam campaign originating from this IP. The server hosted multiple unsolicited emails promoting counterfeit luxury goods (domain: djxdianlan.com).
Technical Evidence:
Campaign: "Luxury Designer Bags" phishing/scam.
Malicious Payload: Links redirecting to books-hot-mark.ru.
Headers Analysis: SPF pass, DKIM none, DMARC pass (policy=none).
Impact: High volume of spam delivered despite antispam filters.
This IP is actively used as a spam relay. Request immediate suspension of the associated account.
show less
Phishing Campaign: Apple/iCloud Impersonation
IP: 101.47.22.111 (BytePlus/Bytedance AS150436) Type: ...
show morePhishing Campaign: Apple/iCloud Impersonation
IP: 101.47.22.111 (BytePlus/Bytedance AS150436) Type: Credential Harvesting / Phishing Target: Apple/iCloud users (Japanese language) Malicious Domain: khtgeh.info (randomly generated, Alibaba registered) Payload: Link to bom.so/AzJJRw (Vietnamese shortener โ fake Apple ID login) Content: Japanese text "Appleใขใซใฆใณใใฎใปใญใฅใชใใฃ้็ฅ" + footer "Apple Inc. All rights reserved." Headers:
X-Mailer: Foxmail 6, 13, 102, 15 [cn]
From: "iCloud" [email protected]
Subject: UTF-8 Base64 encoded
Analysis: Domain shows no legitimate history. Follows automated spam patterns (6-char random subdomain). Infrastructure is BytePlus cloud VPS. Emails mimic official Apple security notifications to harvest credentials.
Recommendation: Flag for phishing. Similar abuse reported against BytePlus/Bytedance cloud instances.
show less
Confirmed phishing campaign targeting Apple users. The IP sent emails spoofing "Apple Inc." with a d ...
show moreConfirmed phishing campaign targeting Apple users. The IP sent emails spoofing "Apple Inc." with a deceptive subject line in Japanese ("Security Settings Update") to European recipients.
Key Indicators:
Sender Spoofing: Claims to be from a French domain (trefle-ingenierie.fr) but uses SendGrid infrastructure.
Malicious Payload: Contains a fake "Apple Authentication Protocol" update link pointing to a SendGrid tracking URL.
Social Engineering: Uses urgency ("Deadline: [DATE]") and threatens account suspension to force credential theft.
Technical Evidence:
Envelope-From pattern: bounces+[ACCOUNT_ID]-[CAMPAIGN_ID]-[TARGET][email protected]
DMARC Status: none (Failed authentication for claimed identity).
HTML Obfuscation: CSS classes use "app1e" (with number 1) to evade filters.
This IP is actively being abused by a specific SendGrid account (ID: 57084968) for credential harvesting. Recommend immediate review of the associated SendGrid account.
show less
Second phishing campaign today hosted on this IP. Payload domain: dutrkqs.mmtofz.cn (phishing page i ...
show moreSecond phishing campaign today hosted on this IP. Payload domain: dutrkqs.mmtofz.cn (phishing page impersonating Japanese credit card service Pocketcard). Delivered via URL shortener bom.so/nJnKJr/
Earlier today same IP hosted dsrzzi.jetgq.cn (ETC-MEISAI impersonation, already reported). Confirmed pattern of bulletproof hosting for Japanese phishing campaigns.
Hosting provider: Scloud Pte Ltd, AS142002, Tokyo.
show less
Second phishing campaign today from BYTEPLUS-SG AS150436. Earlier campaign used 101.47.21.12 (same / ...
show moreSecond phishing campaign today from BYTEPLUS-SG AS150436. Earlier campaign used 101.47.21.12 (same /18 block, already reported).
This IP is the authenticated originating sender (SPF/DKIM pass) of a phishing email impersonating Japanese prepaid card service Pocketcard.
Sending domain: qknguj.info (randomized .info)
Payload: https://bom.so/nJnKJr/ (URL shortener)
X-mailer: Foxmail 6, 13, 102, 15 [cn]
Both campaigns share identical fingerprints: same mailer, randomized 6-char .info domains, MIME boundary prefixed 'Dragon'.
show less
This IP hosts the payload domain of an active phishing campaign impersonating the Japanese ETC toll ...
show moreThis IP hosts the payload domain of an active phishing campaign impersonating the Japanese ETC toll road inquiry service (ETC-MEISAI / ETCๅฉ็จ็ งไผใตใผใใน).
Payload URL: https://dsrzzi.jetgq.cn/jkautixtf/londut/
Hosting IP: 165.154.231.146 (Scloud Pte Ltd, AS142002, Tokyo)
Payload domain: dsrzzi.jetgq.cn
The phishing email was sent on 2026-05-21 at 01:51 UTC from IP 101.47.21.12 (BYTEPLUS-SG, AS150436, ByteDance infrastructure, Singapore) using a randomized sender domain (nmxtfz.info). The message was crafted in Japanese and targeted victims of the ETC-MEISAI toll road service, using a fake account expiration notice to lure them into submitting credentials on the above URL.
The payload URL has been independently confirmed as malicious by Netcraft (classified malicious at 08:51 UTC on 2026-05-21) and reported to Google Safe Browsing, JPCERT/CC, OpenPhish, and SPAM.org.
The sending IP (101.47.21.12) has also been reported separately on AbuseIPDB.
show less
This IP was used as the originating sender of a phishing/spam email campaign impersonating a Japanes ...
show moreThis IP was used as the originating sender of a phishing/spam email campaign impersonating a Japanese toll road inquiry service (ETC-MEISAI). The message was crafted in Japanese, sent from a randomized .info domain (nmxtfz.info), and contained a fraudulent call-to-action button linking to a .cn domain (dsrzzi.jetgq.cn).
Email headers confirm 101.47.21.12 as the authenticated sending host (SPF pass). The mailer identified itself as Foxmail 6.13 [cn].
Received headers show routing through asp-relay-spacemail.jellyfish.systems before delivery. DKIM passed on the sending domain, suggesting an organized infrastructure reusing legitimate relay paths.
Category: Phishing / Spam
Sending domain: nmxtfz.info
Payload domain: dsrzzi.jetgq.cn
X-mailer: Foxmail 6, 13, 102, 15 [cn]
Target: Italian recipient, impersonated service in Japanese
show less
PhishingEmail Spam
By clicking โAccept allโ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.