AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Gnax Henc joined AbuseIPDB in June 2026 and has reported 105 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇳🇱 188.93.233.184	18 Aug 2026	This IP, in the same /24 as a previously reported IP from this operator, relayed a genuine SPF/DKIM- ... show more This IP, in the same /24 as a previously reported IP from this operator, relayed a genuine SPF/DKIM-authenticated auto-insurance lead-gen spam email. Its PTR (cinema.tim.it) is a fabricated value impersonating Italian telecom TIM, distinct from but consistent with the same operator's pattern of hardcoding different trust-borrowed PTR strings across IPs in this block. Payload redirects to a Google Cloud Storage page already confirmed hosting at least four other unrelated phishing/spam lures. show less	Phishing Email Spam Spoofing
🇳🇱 194.62.122.246	18 Aug 2026	This IP relayed a genuine, SPF/DKIM-authenticated iCloud-impersonation phishing email, confirmed via ... show more This IP relayed a genuine, SPF/DKIM-authenticated iCloud-impersonation phishing email, confirmed via matching client-ip in Received-SPF and Authentication-Results. Its PTR (gigya.mlssoccer.com) is a hardcoded value already observed on two other unrelated netblocks used by the same operator, evidence of a repeating trust-borrowing pattern rather than genuine reverse DNS. Payload redirects to a Google Cloud Storage credential-harvesting page. show less	Phishing Email Spam Spoofing
🇬🇧 63.250.53.24	18 Aug 2026	This IP (PTR gigya.mlssoccer.com, hardcoded across unrelated netblocks in a tracked campaign) served ... show more This IP (PTR gigya.mlssoccer.com, hardcoded across unrelated netblocks in a tracked campaign) served as the confirmed genuine relay, via SPF pass and matching Authentication-Results, for a Medicare/MyChart-impersonation phishing email. A fabricated decoy Received line (efianalytics.com/216.244.76.116) was also present but not the actual connecting host. The message linked to a Google Cloud Storage credential/lead-harvesting redirector. show less	Phishing Email Spam
🇨🇦 2600:3c04::2000:94ff:fe85:c285	02 Aug 2026	This IPv6 address (Linode) served as the genuine SMTP relay for a government-impersonation advance-f ... show more This IPv6 address (Linode) served as the genuine SMTP relay for a government-impersonation advance-fee scam, confirmed via SPF pass and matching Authentication-Results. The message's Received line combined two simultaneous fabricated brand identities (a Cisco Networking Academy HELO claim and an Infiniti-impersonating reverse DNS string) unrelated to the actual sending domain. It impersonated the U.S. Treasury with a fake wartime emergency disbursement and linked to a Google Cloud Storage credential-harvesting page. show less	Phishing Email Spam
🇫🇮 37.27.217.69	02 Aug 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF/DKIM/DMARC all pa ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF/DKIM/DMARC all passing for a self-controlled throwaway domain. Reverse DNS is genuine Hetzner hosting infrastructure, not spoofed. The message impersonated a Google Drive-style storage-lockout notice and linked to a Google Cloud Storage credential-harvesting page. This specimen shares distinctive structural fingerprints (multipart/report MIME misuse, identical plain-text boilerplate, SendGrid-style Message-ID impersonation) with another specimen reported two days prior from unrelated infrastructure, confirming one operator. show less	Phishing Email Spam
🇬🇧 185.75.240.210	02 Aug 2026	This IP served as the connecting host for a romance-scam spam message, confirmed via SPF pass for th ... show more This IP served as the connecting host for a romance-scam spam message, confirmed via SPF pass for the envelope domain (though DKIM failed entirely — no published key — and the visible From domain doesn't match the SPF-authenticated envelope domain). Reverse DNS resolved to a free dynamic-DNS hostname (hopto.org) rather than a fixed PTR. The message impersonated a dating-site match notification and linked to a Google Cloud Storage-hosted redirect page. show less	Phishing Email Spam
🇳🇱 188.93.233.184	01 Aug 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. It sits in the same /24 as another IP already confirmed abusive in this tracked campaign. Reverse DNS was set to impersonate a major Italian telecom operator's subdomain, a different spoofed brand than previously observed on a neighboring IP in the same block, confirming the operator controls a range within this netblock rather than a single leased address. The message carried a fabricated decoy Received line and impersonated a healthcare patient-portal brand with a fake Medicare benefits offer. show less	Phishing Email Spam
🇩🇪 46.8.182.46	20 Jul 2026	Verified relay — repeat offender IP, iCloud phish IP: 46.8.182.46 \| Received: Mon, 20 Jul 202 ... show more Verified relay — repeat offender IP, iCloud phish IP: 46.8.182.46 \| Received: Mon, 20 Jul 2026 06:54:12 +0000 Envelope: [email protected] DKIM: d=jlxmvhxp.aasx.fetosm.co.uk s=smtp rsa-sha1 Msg-ID: <ujdgbvdneslcsbfzqcwwcztpzsrgzr@oso2fany6ea9h5oeae> Evidence: SPF pass / Received-SPF client-ip= match. Confirmed genuine relay. Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html Pattern: this exact IP previously sent a DirectMeds ad (sumiamp.me) on 2026-07-04 — now reused 16 days later under a different domain/lure. Third confirmed case of this operator recycling IPs (also seen with 94.125.163.211 and 205.251.145.44, each ~7 days). Same Panel Family A fingerprint across 20+ specimens spanning 16+ days. show less	Phishing Email Spam Spoofing
🇳🇱 216.252.238.71	20 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to impersonate a Portuguese telecom/portal company's subdomain, unrelated to this network — a string already confirmed on unrelated netblocks in this tracked campaign. It impersonated iCloud and linked to a Google Cloud Storage credential-harvesting page. show less	Phishing Email Spam Spoofing
🇺🇸 205.251.145.82	20 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. It sits in the same /24 as another IP already confirmed abusive in this campaign, owned by Network Transit Holdings LLC. The message carried a fabricated decoy Received line, and reverse DNS was set to impersonate a major retailer's customer service subdomain, unrelated to this network. It impersonated a cloud-account lockout notice and linked to a Google Cloud Storage page confirmed reused across fourteen sends spanning six TLDs. show less	Phishing Email Spam Spoofing
🇭🇰 45.124.64.113	20 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, using a HELO string designed to visually resemble Google infrastructure. Reverse DNS was set to impersonate a real technology/publishing company's internal development subdomain — a string now confirmed on a second unrelated IP within this same tracked campaign. The message contained two additional fabricated decoy Received lines and a shared Mailgun sending-container identifier already confirmed across multiple unrelated prior specimens. It impersonated a generic cloud storage payment-failure notice and linked to a previously-confirmed Google Cloud Storage bucket/object. show less	Phishing Email Spam Spoofing
🇺🇸 205.251.145.6	20 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. This same IP was previously confirmed as the relay for an unrelated specimen in this same tracked campaign five days earlier, indicating the operator reuses infrastructure across the pool rather than permanently rotating away from it. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string confirmed across numerous unrelated netblocks in this ongoing campaign. It impersonated iCloud and linked to a Google Cloud Storage page confirmed reused across thirteen sends spanning six days and five TLDs. show less	Phishing Email Spam Spoofing
🇩🇪 46.8.182.46	19 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string now confirmed across eleven or more unrelated netblocks in an ongoing tracked campaign. It impersonated iCloud and linked to a Google Cloud Storage page confirmed reused across twelve sends spanning six days and four different TLDs. show less	Phishing Email Spam Spoofing
🇳🇱 185.185.40.126	19 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, using a HELO string designed to visually resemble Google infrastructure. Reverse DNS was set to impersonate a real technology company's internal development subdomain, unrelated to this network. The message contained two additional fabricated, structurally invalid decoy Received lines spoofing Substack and Twitter, a shared Mailgun sending-container identifier already confirmed across multiple unrelated prior specimens, and a self-referential envelope sender constructed directly from the recipient's own email local-part. It impersonated a generic cloud storage payment-failure notice and linked to a Google Cloud Storage credential-harvesting page from an already-catalogued bucket. show less	Phishing Email Spam Spoofing
🇩🇪 77.90.8.63	19 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string impersonating a public broadcasting organization's domain, unrelated to this network. The message impersonated a cloud-account lockout notice and linked to a Google Cloud Storage page confirmed reused across eleven sends spanning multiple days. show less	Phishing Email Spam
🇹🇷 31.210.52.54	19 Jul 2026	This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF ... show more This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, with DMARC also passing for the sending domain. The message carried three fabricated, structurally invalid decoy Received lines impersonating a legitimate email marketing platform and an unrelated fabricated IP, designed to mislead casual header review. Reverse DNS was set to impersonate a Portuguese university subdomain unrelated to this network. The message impersonated a Costco prize giveaway and linked to a Google Cloud Storage credential-harvesting page via both a direct link and a TinyURL-shortened tracking pixel. show less	Phishing Email Spam Spoofing
🇳🇱 46.8.127.149	19 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string already confirmed across ten unrelated netblocks in an ongoing tracked campaign, including two other IPs in the same 46.8.0.0/16 block. It impersonated iCloud and linked to a Google Cloud Storage page confirmed reused across ten sends spanning five days. show less	Phishing Email Spam Spoofing
🇫🇷 178.170.102.133	18 Jul 2026	This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ... show more This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string impersonating a major automaker's marketing-email subdomain, unrelated to this network. The message impersonated an account-lockout notice and linked to a Google Cloud Storage page confirmed reused across nine sends spanning multiple days and lure verticals. show less	Phishing Email Spam Spoofing
🇩🇪 77.90.51.85	17 Jul 2026	This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF ... show more This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF pass and matching Authentication-Results client-IP alignment (client-ip=77.90.51.85). The message carried a fabricated, structurally invalid decoy Received line naming an unrelated third-party IP (efianalytics.com / 216.244.76.116), inserted to mislead casual header review. Reverse DNS on this host was set to "adgame.fruitmail.net," a string now confirmed identically across nine separate, unrelated netblocks in an ongoing tracked campaign, indicating operator-controlled reverse DNS rather than genuine per-host records. The message advertised hearing aid devices under the sender name "Affordable_Hearing_Devices" and linked to a Google Cloud Storage page (storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html) that has been confirmed reused, byte-for-byte, across at least eight separate sends since July 14, 2026, spanning multiple unrelated lure verticals and sending domains. show less	Phishing Email Spam Spoofing
🇫🇷 178.170.116.90	17 Jul 2026	Genuine relay confirmed via SPF/Authentication-Results, reverse DNS matching the now 8-IP-wide adgam ... show more Genuine relay confirmed via SPF/Authentication-Results, reverse DNS matching the now 8-IP-wide adgame.fruitmail.net fingerprint, fabricated decoy Received line, GCS payload reused across seven sends spanning multiple days. show less	Phishing Email Spam Spoofing
🇹🇷 86.105.4.181	17 Jul 2026	This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Auth ... show more This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. Reverse DNS was set to a string already confirmed on at least six other unrelated netblocks in an ongoing tracked campaign. The message carried a fabricated decoy Received line and impersonated iCloud, linking to a Google Cloud Storage page confirmed reused across six sends spanning multiple days. show less	Phishing Email Spam Spoofing
🇹🇷 193.25.218.98	17 Jul 2026	This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Auth ... show more This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string already confirmed on multiple other unrelated netblocks in an ongoing tracked campaign. It impersonated iCloud and linked to a Google Cloud Storage credential-harvesting page that has been confirmed reused, byte-for-byte, across at least five sends spanning several days and multiple unrelated lure verticals. show less	Phishing Email Spam Spoofing
🇨🇭 86.106.158.93	16 Jul 2026	This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Auth ... show more This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, using a HELO string designed to visually resemble Google infrastructure. Reverse DNS was set to a hostname impersonating an unrelated footwear brand. The message contained two additional fabricated, structurally invalid decoy Received lines spoofing Substack and Twitter, a shared Mailgun sending-container identifier already observed in unrelated prior specimens, and a self-referential envelope construction using the recipient's own address local-part. It impersonated a Google Account security notice and linked to a Google Cloud Storage credential-harvesting page. show less	Phishing Email Spam Spoofing
🇩🇪 46.8.182.43	15 Jul 2026	This IP served as the genuine relay for a phishing/scam-advertising message, confirmed via SPF/Authe ... show more This IP served as the genuine relay for a phishing/scam-advertising message, confirmed via SPF/Authentication-Results client-IP match. Reverse DNS was set to a string ("adgame.fruitmail.net") already observed identically on multiple unrelated netblocks; this specific IP also falls in the same /24 as another previously-reported IP carrying the identical PTR, suggesting the operator controls a range within this subnet rather than a single leased address. The message impersonated a life-insurance broker and linked to a Google Cloud Storage page reused byte-for-byte across at least three other lures sent from unrelated infrastructure the same evening. show less	Phishing Email Spam
🇹🇷 104.247.173.252	15 Jul 2026	This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF/ ... show more This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF/Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string now confirmed identically across five unrelated netblocks, indicating operator-controlled PTR rather than genuine per-host records. The message impersonated a hearing-aid retailer and linked to a Google Cloud Storage landing page that was reused, byte-for-byte, across at least two other unrelated lures sent from different infrastructure earlier the same evening. show less	Phishing Email Spam