Sent phishing/scam email on 2026-10-04 12:07 PDT, using a fabricated Received header impersonating a ...
show moreSent phishing/scam email on 2026-10-04 12:07 PDT, using a fabricated Received header impersonating a different sender and a forged reverse-DNS string naming an unrelated university department ("jewishstudies.shanti.virginia[.]edu").
show less
Sending IP for unsolicited adult-content spam carrying a fabricated decoy Received line (efianalytic ...
show moreSending IP for unsolicited adult-content spam carrying a fabricated decoy Received line (efianalytics.com, 216.244.76.116 — not a real relay) and Gmail-UI-spoofing headers (X-Google-Sender-Delegation naming the recipient's own address as "Trusted Sender"; hardcoded X-Google-Original-Message-ID). Genuine relay confirmed via Received-SPF client-ip and Authentication-Results. PTR is a "demo" subdomain of a Russian VPS reseller (x5.ru), consistent with throwaway spam infrastructure. Same hosting ASN (24961) as another spam IP sending an identical payload bucket the same day.
show less
Sending IP for unsolicited adult-content spam with fabricated Received-line filler (pdr8-services-05 ...
show moreSending IP for unsolicited adult-content spam with fabricated Received-line filler (pdr8-services-05v.prod.PYY28AGM.org, ip6-localhost — not a real relay) and a fake PTR (testtoolkitshop.coca-cola.com) borrowing an unrelated brand name. Confirmed genuine relay via Received-SPF client-ip and Authentication-Results. Same fake-PTR/IP pairing seen on a separate specimen from this IP the previous day, indicating ongoing use as spam-sending infrastructure rather than a one-off.
show less
Relayed advance-fee fraud email on 2026-09-26 23:24:06 UTC via Roundcube webmail, authenticated ESMT ...
show moreRelayed advance-fee fraud email on 2026-09-26 23:24:06 UTC via Roundcube webmail, authenticated ESMTPA submission from internal host 157.92.88.10, so the sending mailbox on this university mail server appears compromised. Message is DKIM-signed and passes SPF and DMARC (p=none) for the university domain, impersonates a central bank chief executive, is sent to undisclosed recipients, and offers a "profitable deal worth 12.8m USD" with a Reply-To at a lookalike .cc domain hosted on Zoho. Consistent with the 2026-09-24 report of the same pattern.
show less
IP confirmed via Received-SPF (client-ip=51.89.72.183) and Authentication-Results as the genuine sen ...
show moreIP confirmed via Received-SPF (client-ip=51.89.72.183) and Authentication-Results as the genuine sending relay for a phishing email impersonating UnitedHealthcare ('Oral Care Bonus' survey scam). Fabricated reverse-hostname (gigya.mlssoccer.com) layered on the real IP. Message carries the known efianalytics.com/216.244.76.116 decoy Received line, the X-Google-Sender-Delegation 'Trusted Sender' Gmail UI-spoofing header, and the byte-identical X-Google-Original-Message-ID: [email protected] placeholder. Phishing payload hosted at storage.googleapis.com/bobalomaniaz/bazonamolapa.html, with corpus-poisoning filler content byte-identical to two other specimens reported this same week (2026-09-22, 2026-09-25 ALDI), confirming a shared template batch.
show less
IP confirmed via Received-SPF (client-ip=103.41.207.140) and Authentication-Results as the genuine s ...
show moreIP confirmed via Received-SPF (client-ip=103.41.207.140) and Authentication-Results as the genuine sending relay for a phishing email impersonating ALDI ('$500 Gift Card' giveaway/prize scam). Fabricated reverse-hostname (agentevirtual.ticket.com.br) layered on the real IP. Message carries the known efianalytics.com/216.244.76.116 decoy Received line, the X-Google-Sender-Delegation 'Trusted Sender' Gmail UI-spoofing header, and the byte-identical X-Google-Original-Message-ID: [email protected] placeholder, all confirmed across multiple related specimens. Phishing payload hosted at storage.googleapis.com/bobalomaniaz/bazonamolapa.html, using the identical bucket, object name, and TinyURL shortcode (tinyurl.com/yhr7nyde) as a related specimen reported 2026-09-22, indicating the same template batch.
show less
IP confirmed via Received-SPF (client-ip=185.164.184.22) and Authentication-Results as the genuine s ...
show moreIP confirmed via Received-SPF (client-ip=185.164.184.22) and Authentication-Results as the genuine sending relay for a phishing email impersonating UnitedHealthcare ('Oral-B Dental Kit' giveaway/prize scam). Fabricated HELO identities (google.selixgrowth.my.id, jeu-trendtrotters.celio.com) layered on the real IP. Message carries the known efianalytics.com/216.244.76.116 decoy Received line, the X-Google-Sender-Delegation 'Trusted Sender' Gmail UI-spoofing header, and the byte-identical X-Google-Original-Message-ID: [email protected] placeholder seen across multiple related specimens. Phishing payload hosted at storage.googleapis.com/bobalomaniaz/bazonamolapa.html, a reused bucket from earlier reports in this same campaign.
show less
IP confirmed via Received-SPF (client-ip=77.83.246.84) and Authentication-Results as the genuine sen ...
show moreIP confirmed via Received-SPF (client-ip=77.83.246.84) and Authentication-Results as the genuine sending relay for a phishing email impersonating Ace Hardware ('YETI PATRIOTIC Bundle' giveaway/survey scam). Connecting host fronted by a free No-IP Dynamic DNS hostname (ukfghf.blogsyte.com) with a fabricated .local HELO. Message also carries a fabricated internal-relay decoy Received line claiming an ip6-localhost connecting address, and reuses the recipient's own email address as MIME boundary delimiters. Phishing payload hosted at storage.googleapis.com/xacto/storage.datavero.htm
show less
IP confirmed via Received-SPF (client-ip=209.58.148.7) and Authentication-Results as the genuine sen ...
show moreIP confirmed via Received-SPF (client-ip=209.58.148.7) and Authentication-Results as the genuine sending relay for a phishing email impersonating a generic 'Cloud ID locked' data-loss threat. Fabricated HELO identity (testtoolkitshop.coca-cola.com) layered on the real IP. Message carries the known efianalytics.com/216.244.76.116 decoy Received line, a misspelled 'multipart/reporat' MIME type disguising the payload as a delivery-status notification, and a malformed double-protocol List-Unsubscribe URL. Sending domain (qkoh.jknttzepkvzmi.us) shows randomized subdomain rotation. Phishing payload hosted at storage.googleapis.com/netwrok24/cloud.html, using the same hex-dot URL-obfuscation scheme as a related specimen hosted on titanwasteserv.com.
show less
IP confirmed via Received-SPF and Authentication-Results as the genuine sending relay for a phishing ...
show moreIP confirmed via Received-SPF and Authentication-Results as the genuine sending relay for a phishing email impersonating a generic auto-insurance rate notice. Evidence indicates a compromised legitimate website (titanwasteserv.com) being used as both spam relay (local PHP-mailer submission via 127.0.0.1) and phishing redirect host (active r3e60.php script with hex-encoded tracking parameters). Message also recycles genuine, unrelated corporate mail-infrastructure headers (Enel, Eni, Generali, UniCredit, Intesa Sanpaolo, Beehiiv) as camouflage padding, and uses CSS bidi-override text reversal to hide the visible payload from plain-text scanners.
show less
IP confirmed via Received-SPF (client-ip=199.204.140.69) and Authentication-Results as the genuine s ...
show moreIP confirmed via Received-SPF (client-ip=199.204.140.69) and Authentication-Results as the genuine sending relay for a phishing email impersonating AAA ('Complimentary AAA Car Emergency Kit'). The message carries three stacked, structurally invalid decoy Received lines (mta8132.mp2200.com/162.247.118.132, vmta186.85.lstrk.net/142.0.85.186, efianalytics.com/216.244.76.116), none of which are real mail hops, borrowing recognizable ESP/tracking-platform names as filler. Sending domain (goxemmrz.mailqorix.co.za / frfvcgfdc.mailqorix.co.za) shows randomized DKIM/envelope subdomain rotation. Connecting host presents a dynamic-DNS reverse hostname (damnserver.com, Afraid.org). Phishing payload hosted at storage.googleapis.com/cocodrillo/thannina.html.
show less
IP confirmed via Received-SPF (client-ip=51.68.7.175) and Authentication-Results as the genuine send ...
show moreIP confirmed via Received-SPF (client-ip=51.68.7.175) and Authentication-Results as the genuine sending relay for a phishing email impersonating a generic cloud-storage payment-failure notice. Fabricated HELO identities (docs.google.com, dashboard.freedommobile.ca) layered on the real IP. Message also carries a structurally invalid decoy Received line (efianalytics.com/216.244.76.116) whose id= field leaks the real payload's tracking querystring, a known bug in this toolkit. Sending domain (VjlB.sb010.dynamiclogicgrid.my.id) shows randomized DKIM-subdomain rotation and self-referential spoofing (recipient's own Gmail username embedded in the Sender: address). Phishing payload hosted at storage.googleapis.com/obsidianly/obsidianly.html.
show less
IP confirmed via Received-SPF (client-ip=77.90.40.114) and Authentication-Results as the genuine sen ...
show moreIP confirmed via Received-SPF (client-ip=77.90.40.114) and Authentication-Results as the genuine sending relay for a phishing email impersonating Paramount+ membership billing. The message also carries a structurally invalid decoy Received line (efianalytics.com/216.244.76.116, no valid by/with/id/for/timestamp fields) inserted to misdirect analysis, a fabricated-header technique. Sending domain (azedef.smarthomehou.us.com) uses randomized DKIM-subdomain rotation per message. Phishing payload hosted at storage.googleapis.com/mzcomdirec/mzcome.html.
show less
This IP, in the same /24 as a previously reported IP from this operator, relayed a genuine SPF/DKIM- ...
show moreThis IP, in the same /24 as a previously reported IP from this operator, relayed a genuine SPF/DKIM-authenticated auto-insurance lead-gen spam email. Its PTR (cinema.tim.it) is a fabricated value impersonating Italian telecom TIM, distinct from but consistent with the same operator's pattern of hardcoding different trust-borrowed PTR strings across IPs in this block. Payload redirects to a Google Cloud Storage page already confirmed hosting at least four other unrelated phishing/spam lures.
show less
This IP relayed a genuine, SPF/DKIM-authenticated iCloud-impersonation phishing email, confirmed via ...
show moreThis IP relayed a genuine, SPF/DKIM-authenticated iCloud-impersonation phishing email, confirmed via matching client-ip in Received-SPF and Authentication-Results. Its PTR (gigya.mlssoccer.com) is a hardcoded value already observed on two other unrelated netblocks used by the same operator, evidence of a repeating trust-borrowing pattern rather than genuine reverse DNS. Payload redirects to a Google Cloud Storage credential-harvesting page.
show less
This IP (PTR gigya.mlssoccer.com, hardcoded across unrelated netblocks in a tracked campaign) served ...
show moreThis IP (PTR gigya.mlssoccer.com, hardcoded across unrelated netblocks in a tracked campaign) served as the confirmed genuine relay, via SPF pass and matching Authentication-Results, for a Medicare/MyChart-impersonation phishing email. A fabricated decoy Received line (efianalytics.com/216.244.76.116) was also present but not the actual connecting host. The message linked to a Google Cloud Storage credential/lead-harvesting redirector.
show less
This IPv6 address (Linode) served as the genuine SMTP relay for a government-impersonation advance-f ...
show moreThis IPv6 address (Linode) served as the genuine SMTP relay for a government-impersonation advance-fee scam, confirmed via SPF pass and matching Authentication-Results. The message's Received line combined two simultaneous fabricated brand identities (a Cisco Networking Academy HELO claim and an Infiniti-impersonating reverse DNS string) unrelated to the actual sending domain. It impersonated the U.S. Treasury with a fake wartime emergency disbursement and linked to a Google Cloud Storage credential-harvesting page.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF/DKIM/DMARC all pa ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF/DKIM/DMARC all passing for a self-controlled throwaway domain. Reverse DNS is genuine Hetzner hosting infrastructure, not spoofed. The message impersonated a Google Drive-style storage-lockout notice and linked to a Google Cloud Storage credential-harvesting page. This specimen shares distinctive structural fingerprints (multipart/report MIME misuse, identical plain-text boilerplate, SendGrid-style Message-ID impersonation) with another specimen reported two days prior from unrelated infrastructure, confirming one operator.
show less
This IP served as the connecting host for a romance-scam spam message, confirmed via SPF pass for th ...
show moreThis IP served as the connecting host for a romance-scam spam message, confirmed via SPF pass for the envelope domain (though DKIM failed entirely — no published key — and the visible From domain doesn't match the SPF-authenticated envelope domain). Reverse DNS resolved to a free dynamic-DNS hostname (hopto.org) rather than a fixed PTR. The message impersonated a dating-site match notification and linked to a Google Cloud Storage-hosted redirect page.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. It sits in the same /24 as another IP already confirmed abusive in this tracked campaign. Reverse DNS was set to impersonate a major Italian telecom operator's subdomain, a different spoofed brand than previously observed on a neighboring IP in the same block, confirming the operator controls a range within this netblock rather than a single leased address. The message carried a fabricated decoy Received line and impersonated a healthcare patient-portal brand with a fake Medicare benefits offer.
show less
Verified relay — repeat offender IP, iCloud phish
IP: 46.8.182.46 | Received: Mon, 20 Jul 202 ...
show moreVerified relay — repeat offender IP, iCloud phish
IP: 46.8.182.46 | Received: Mon, 20 Jul 2026 06:54:12 +0000
Envelope: [email protected]
DKIM: d=jlxmvhxp.aasx.fetosm.co.uk s=smtp rsa-sha1
Msg-ID: <ujdgbvdneslcsbfzqcwwcztpzsrgzr@oso2fany6ea9h5oeae>
Evidence: SPF pass / Received-SPF client-ip= match. Confirmed genuine relay.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
Pattern: this exact IP previously sent a DirectMeds ad (sumiamp.me) on
2026-07-04 — now reused 16 days later under a different domain/lure.
Third confirmed case of this operator recycling IPs (also seen with
94.125.163.211 and 205.251.145.44, each ~7 days). Same Panel Family A
fingerprint across 20+ specimens spanning 16+ days.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to impersonate a Portuguese telecom/portal company's subdomain, unrelated to this network — a string already confirmed on unrelated netblocks in this tracked campaign. It impersonated iCloud and linked to a Google Cloud Storage credential-harvesting page.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. It sits in the same /24 as another IP already confirmed abusive in this campaign, owned by Network Transit Holdings LLC. The message carried a fabricated decoy Received line, and reverse DNS was set to impersonate a major retailer's customer service subdomain, unrelated to this network. It impersonated a cloud-account lockout notice and linked to a Google Cloud Storage page confirmed reused across fourteen sends spanning six TLDs.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, using a HELO string designed to visually resemble Google infrastructure. Reverse DNS was set to impersonate a real technology/publishing company's internal development subdomain — a string now confirmed on a second unrelated IP within this same tracked campaign. The message contained two additional fabricated decoy Received lines and a shared Mailgun sending-container identifier already confirmed across multiple unrelated prior specimens. It impersonated a generic cloud storage payment-failure notice and linked to a previously-confirmed Google Cloud Storage bucket/object.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. This same IP was previously confirmed as the relay for an unrelated specimen in this same tracked campaign five days earlier, indicating the operator reuses infrastructure across the pool rather than permanently rotating away from it. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string confirmed across numerous unrelated netblocks in this ongoing campaign. It impersonated iCloud and linked to a Google Cloud Storage page confirmed reused across thirteen sends spanning six days and five TLDs.
show less
Email SpamSpoofingPhishing
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.