Follow-up: Same IP re-used June 21 for BioLife Plasma PII scam after 4-day rotation. Payload: storag ...
show moreFollow-up: Same IP re-used June 21 for BioLife Plasma PII scam after 4-day rotation. Payload: storage.googleapis.com/bobalomaniaz/bazonamolapa.html — same bucket as June 17 report, still active. Same rDNS gigya.mlssoccer.com recycled. Same recipient ID 14327359 as June 17 campaign. New envelope domain google.fenravoqore.biz (third Google-subdomain-impersonating .biz domain from this operator). efianalytics.com (216.244.76.116) eighth confirmed session appearance. Operator confirmed to rotate through multiple hosting providers before returning to this Ukrainian BPH IP. GCP cases 29343041506 and KAB6XEPDZ52IFXKS5UTLOK2Q5Q.
show less
Liteserver/Holland IP sending iCloud payment phishing with per-character HTML span obfuscation. Payl ...
show moreLiteserver/Holland IP sending iCloud payment phishing with per-character HTML span obfuscation. Payload: storage.googleapis.com/ousjasdsakhsgg/dsfgdfgdseewwe.html — fourth confirmed use of this bucket across four IPs in ~6 hours. Envelope: sest.mexumia.biz (DKIM rotation d=kvhyvthv.sest.mexumia.biz). rDNS trust-borrows cml.m.me.ford.com (recycled PTR, previously seen on 50.6.242.197). efianalytics.com (216.244.76.116 / Wowrack AS27323) seventh session appearance as persistent injector. Campaign serials 2031/427. Received Sat 20 Jun 2026 23:21 UTC.
show less
M247 Ltd IP (AS9009) sending iCloud payment expiry phishing with per-character HTML span obfuscation ...
show moreM247 Ltd IP (AS9009) sending iCloud payment expiry phishing with per-character HTML span obfuscation. Payload: storage.googleapis.com/ousjasdsakhsgg/dsfgdfgdseewwe.html — third confirmed use of this bucket, now across three IPs within 8 hours. Envelope: erbg.aihubmodel.biz (DKIM rotation d=xrmfzycx.erbg.aihubmodel.biz). rDNS trust-borrows ladyactive.clarins.com (recycled PTR, previously seen on 64.22.104.144). efianalytics.com (216.244.76.116 / Wowrack AS27323) sixth session appearance as persistent Received-chain injector. Campaign serials 1955/5611820. Received Sat 20 Jun 2026 02:18 UTC.
show less
IP sending Sam's Club / All-Clad cookware survey scam. Payload: storage.googleapis.com/sfdcsdfsdfsdf ...
show moreIP sending Sam's Club / All-Clad cookware survey scam. Payload: storage.googleapis.com/sfdcsdfsdfsdfsdfs/asdsdaadadasasd.html (fifth GCS bucket from same operator cluster). Envelope: rr.toimena.co.uk (.co.uk British ccTLD, DKIM rotation d=rqkbzqqg.rr.toimena.co.uk). rDNS trust-borrows mundogaturro.uol.com.br (UOL Brazil children's gaming platform). efianalytics.com (216.244.76.116 / Wowrack AS27323) in Received chain — fifth confirmed appearance across campaign series, active since 2021. Confirmed multi-account targeting across operator list. X-Original-Sender header contains javascript:void(0) suffix — panel template rendering bug. Campaign serial 471961 in fragment tokens and Content-Length headers. Received Fri 19 Jun 2026 02:15 PDT.
show less
IP sending cloud storage billing phish (same campaign as 77.90.40.241 reported Jun 17). Payload: sto ...
show moreIP sending cloud storage billing phish (same campaign as 77.90.40.241 reported Jun 17). Payload: storage.googleapis.com/strow/strw_v2.html (bucket still active 48hrs after initial report). Envelope: store.ass0033.loopsnap.biz.ua (.biz.ua Ukrainian TLD, sequential to ass0036.shotflownet.biz.ua). DKIM subdomain rotation (d=CRg4.store.ass0033.loopsnap.biz.ua, s=mail). rDNS trust-borrows sam-dev.kibana.pearson.com. Forged Received headers impersonating Substack (mg-202-170.substack.com) and Twitter (spruce-goose-ax.twitter.com). Fabricated Mailgun headers and Substack Feedback-ID. Bayesian corpus poisoning in hidden MIME parts. Panel params: pid=23287_md, ofid=423, lid=175, cid=47061. Same lid/cid as Jun 17 campaign confirming same panel instance. Received Fri 19 Jun 2026 13:36 PDT.
show less
Persistent cross-campaign origin injector. Appears in Received headers of every campaign in a large ...
show morePersistent cross-campaign origin injector. Appears in Received headers of every campaign in a large spam/phishing cluster active June 10-19 2026. Confirmed lure types: iCloud payment expiry phishing, Lowe's prize scam (RIDGID/Kobalt), BioLife plasma donation scam, gambling spam. All campaigns route through this node before delivery via rotating VPS IPs (Limestone Networks AS36444, Vultr AS20473, Contabo AS51167, Ukrainian bulletproof). Associated GCS payload buckets: strow, bobalomaniaz, ousjasdsakhsgg, secureencryption-track. Fabricates X-Google-Sender-Delegation, X-Original-Sender, X-Google-Original-Message-ID headers across all campaigns. Google Cloud abuse reports filed under Case ID 29343041506.
show less
Limestone Networks IP (AS36444) sending iCloud payment expiry phishing with per-character HTML span ...
show moreLimestone Networks IP (AS36444) sending iCloud payment expiry phishing with per-character HTML span obfuscation (every character in separate span tag to defeat text extraction). Payload: storage.googleapis.com/ousjasdsakhsgg/dsfgdfgdseewwe.html. Domain erge.bathloike.info (DKIM rotation d=anpexkts.erge.bathloike.info). rDNS: cml.m.me.ford.com (Ford trust-borrowing, recycled PTR). efianalytics.com (216.244.76.116) in Received chain — fourth confirmed appearance. From field spoofs recipient username. Campaign serials 1955/5611820. Fourth Limestone IP in series (prior: 172.93.52.138, 172.93.51.65, 50.114.74.228 already reported). Sent 20 seconds after Email #6 in same campaign run. Received Fri 19 Jun 2026 11:17:56 PDT.
show less
Limestone Networks IP (AS36444) sending Lowe's RIDGID prize scam. Payload: storage.googleapis.com/ou ...
show moreLimestone Networks IP (AS36444) sending Lowe's RIDGID prize scam. Payload: storage.googleapis.com/ousjasdsakhsgg/dsfgdfgdseewwe.html. Domain: ehrr.gruty.biz.id (DKIM subdomain rotation d=hcdftkic.ehrr.gruty.biz.id). rDNS: m.customerservice.macys.com (same PTR as prior report for 89.43.31.173). efianalytics.com (216.244.76.116) confirmed in Received chain. Campaign serials 1955/5611820 in fragment tokens and spoofed Content-Length headers. Fabricated CTE: amazonses. Third Limestone Networks IP from this operator (prior: 172.93.52.138, 172.93.51.65 already reported). Received Fri 19 Jun 2026 11:17 PDT.
show less
Contabo VPS (vmi3296222.contaboserver.net) sending Lowe's Kobalt Garden Toolset prize scam. Payload: ...
show moreContabo VPS (vmi3296222.contaboserver.net) sending Lowe's Kobalt Garden Toolset prize scam. Payload: storage.googleapis.com/secureencryption-track/securedwallaccesskey.html. Envelope: malformed redheadsluts.com subdomain with sending IP embedded in labels (panel bug). From domain: tvjmljqayJcgM.com. No DKIM. rDNS: dealdocsonline.com. Campaign seed 740369550 in Date header and Message-ID. Second Contabo IP from same operator; prior IP 161.97.109.34 already reported. Received Thu 18 Jun 2026 07:56 PDT.
show less
Contabo VPS (vmi3064820.contaboserver.net) sending prize-scam email impersonating Lowe's. Payload on ...
show moreContabo VPS (vmi3064820.contaboserver.net) sending prize-scam email impersonating Lowe's. Payload on GCS bucket secureencryption-track. Envelope domain: deeply nested subdomain of cdcfa.com. No DKIM. rDNS trust-borrows integrafinancialservices.com. Template has Russian-language CSS comments. Campaign seed s2=740369550. Received Thu 18 Jun 2026 04:41:54 PDT. Third campaign in series; prior IPs 77.90.40.241 and 77.87.122.45 already submitted.
show less
IP sent prize-scam email impersonating Lowe's retail brand. Payload hosted on GCS bucket: storage.go ...
show moreIP sent prize-scam email impersonating Lowe's retail brand. Payload hosted on GCS bucket: storage.googleapis.com/bobalomaniaz/bazonamolapa.html. Sending domain: google.zorvialabs.biz (Google subdomain impersonation). rDNS: gigya.mlssoccer.com (MLS/SAP Gigya trust-borrowing). DKIM subdomain rotation (d=xraaytde.google.zorvialabs.biz). Fabricated X-Google-Sender-Delegation header. Heavy Bayesian corpus poisoning including YNAB and Enterprise Rent-A-Car email fragments. Same operator/panel as prior campaign from 77.90.40.241 (already reported). Affiliate panel ID: 14327359, campaign seed 7752. Received Thu 18 Jun 2026 03:29:58 UTC.
show less
IP sent phishing email impersonating a cloud storage billing portal. Payload hosted on GCS bucket: s ...
show moreIP sent phishing email impersonating a cloud storage billing portal. Payload hosted on GCS bucket: storage.googleapis.com/strow/strw_v2.html. Sending domain: one.ass0036.shotflownet.biz.ua. DKIM signed under d=oTxw.one.ass0036.shotflownet.biz.ua (subdomain rotation pattern). Email contained forged Received headers impersonating Substack (mg-202-170.substack.com) and Twitter (spruce-goose-ax.twitter.com). Fabricated X-Google-Sender-Delegation and X-Mailgun-* headers to borrow ESP reputation. Bayesian corpus poisoning in hidden MIME parts. Affiliate panel tracking: pid=23146_md, ofid=459, cid=47061. rDNS: dfusion.toms.com. Received: Wed 17 Jun 2026 22:24:42 +0200.
show less
Compromised Ecuadorian government mail server (transvialep.gob.ec).
Credential kcastillo used to s ...
show moreCompromised Ecuadorian government mail server (transvialep.gob.ec).
Credential kcastillo used to send 419 advance-fee fraud via Roundcube
1.6.6 webmail. X-Spamd-Result headers leak ~100 co-recipients per batch.
Two sends within 12 hours Jun 14 2026. Collection address:
[email protected].
show less
Telecentro Argentina IP (AS11664). Customer account
[email protected] sending 4 ...
show moreTelecentro Argentina IP (AS11664). Customer account
[email protected] sending 419 advance-fee fraud
("Mrs. Jennifer Waldemar Stain" $5.8M donation scam). Sent via Zimbra
10.1.11 webmail. Reply-to collection address: [email protected].
show less
Tencent Cloud IP sending Webroot antivirus renewal callback scam.
Fake $249.99 renewal notice with ...
show moreTencent Cloud IP sending Webroot antivirus renewal callback scam.
Fake $249.99 renewal notice with callback numbers +1(828)423-4712 and
+1(202)369-0174. Sent via SendGrid template from throwaway Gmail
[email protected]. Also sending pig-butchering/sha zhu pan
social engineering to multiple targets.
show less
Mailgun EU IP sending iCloud payment expiry phishing. Fabricated PTR
impersonating dfusion.toms.co ...
show moreMailgun EU IP sending iCloud payment expiry phishing. Fabricated PTR
impersonating dfusion.toms.com. Fake Substack/Twitter relay headers
injected. GCS bucket strow as phishing landing page. Domain:
teachunit.biz.ua (.biz.ua Ukrainian TLD). Same toolkit as 193.31.30.61.
show less