This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string now confirmed across eleven or more unrelated netblocks in an ongoing tracked campaign. It impersonated iCloud and linked to a Google Cloud Storage page confirmed reused across twelve sends spanning six days and four different TLDs.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, using a HELO string designed to visually resemble Google infrastructure. Reverse DNS was set to impersonate a real technology company's internal development subdomain, unrelated to this network. The message contained two additional fabricated, structurally invalid decoy Received lines spoofing Substack and Twitter, a shared Mailgun sending-container identifier already confirmed across multiple unrelated prior specimens, and a self-referential envelope sender constructed directly from the recipient's own email local-part. It impersonated a generic cloud storage payment-failure notice and linked to a Google Cloud Storage credential-harvesting page from an already-catalogued bucket.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string impersonating a public broadcasting organization's domain, unrelated to this network. The message impersonated a cloud-account lockout notice and linked to a Google Cloud Storage page confirmed reused across eleven sends spanning multiple days.
show less
This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF ...
show moreThis IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, with DMARC also passing for the sending domain. The message carried three fabricated, structurally invalid decoy Received lines impersonating a legitimate email marketing platform and an unrelated fabricated IP, designed to mislead casual header review. Reverse DNS was set to impersonate a Portuguese university subdomain unrelated to this network. The message impersonated a Costco prize giveaway and linked to a Google Cloud Storage credential-harvesting page via both a direct link and a TinyURL-shortened tracking pixel.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string already confirmed across ten unrelated netblocks in an ongoing tracked campaign, including two other IPs in the same 46.8.0.0/16 block. It impersonated iCloud and linked to a Google Cloud Storage page confirmed reused across ten sends spanning five days.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string impersonating a major automaker's marketing-email subdomain, unrelated to this network. The message impersonated an account-lockout notice and linked to a Google Cloud Storage page confirmed reused across nine sends spanning multiple days and lure verticals.
show less
This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF ...
show moreThis IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF pass and matching Authentication-Results client-IP alignment (client-ip=77.90.51.85). The message carried a fabricated, structurally invalid decoy Received line naming an unrelated third-party IP (efianalytics.com / 216.244.76.116), inserted to mislead casual header review. Reverse DNS on this host was set to "adgame.fruitmail.net," a string now confirmed identically across nine separate, unrelated netblocks in an ongoing tracked campaign, indicating operator-controlled reverse DNS rather than genuine per-host records. The message advertised hearing aid devices under the sender name "Affordable_Hearing_Devices" and linked to a Google Cloud Storage page (storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html) that has been confirmed reused, byte-for-byte, across at least eight separate sends since July 14, 2026, spanning multiple unrelated lure verticals and sending domains.
show less
Genuine relay confirmed via SPF/Authentication-Results, reverse DNS matching the now 8-IP-wide adgam ...
show moreGenuine relay confirmed via SPF/Authentication-Results, reverse DNS matching the now 8-IP-wide adgame.fruitmail.net fingerprint, fabricated decoy Received line, GCS payload reused across seven sends spanning multiple days.
show less
This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Auth ...
show moreThis IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. Reverse DNS was set to a string already confirmed on at least six other unrelated netblocks in an ongoing tracked campaign. The message carried a fabricated decoy Received line and impersonated iCloud, linking to a Google Cloud Storage page confirmed reused across six sends spanning multiple days.
show less
This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Auth ...
show moreThis IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string already confirmed on multiple other unrelated netblocks in an ongoing tracked campaign. It impersonated iCloud and linked to a Google Cloud Storage credential-harvesting page that has been confirmed reused, byte-for-byte, across at least five sends spanning several days and multiple unrelated lure verticals.
show less
This IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Auth ...
show moreThis IP served as the genuine relay for a phishing message, confirmed via SPF pass and matching Authentication-Results client-IP alignment, using a HELO string designed to visually resemble Google infrastructure. Reverse DNS was set to a hostname impersonating an unrelated footwear brand. The message contained two additional fabricated, structurally invalid decoy Received lines spoofing Substack and Twitter, a shared Mailgun sending-container identifier already observed in unrelated prior specimens, and a self-referential envelope construction using the recipient's own address local-part. It impersonated a Google Account security notice and linked to a Google Cloud Storage credential-harvesting page.
show less
This IP served as the genuine relay for a phishing/scam-advertising message, confirmed via SPF/Authe ...
show moreThis IP served as the genuine relay for a phishing/scam-advertising message, confirmed via SPF/Authentication-Results client-IP match. Reverse DNS was set to a string ("adgame.fruitmail.net") already observed identically on multiple unrelated netblocks; this specific IP also falls in the same /24 as another previously-reported IP carrying the identical PTR, suggesting the operator controls a range within this subnet rather than a single leased address. The message impersonated a life-insurance broker and linked to a Google Cloud Storage page reused byte-for-byte across at least three other lures sent from unrelated infrastructure the same evening.
show less
This IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF/ ...
show moreThis IP served as the genuine SMTP relay for a phishing/scam-advertising message, confirmed via SPF/Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS was set to a string now confirmed identically across five unrelated netblocks, indicating operator-controlled PTR rather than genuine per-host records. The message impersonated a hearing-aid retailer and linked to a Google Cloud Storage landing page that was reused, byte-for-byte, across at least two other unrelated lures sent from different infrastructure earlier the same evening.
show less
This IP served as the genuine SMTP relay for a phishing message, confirmed via SPF/Authentication-Re ...
show moreThis IP served as the genuine SMTP relay for a phishing message, confirmed via SPF/Authentication-Results client-IP alignment. The message carried a fabricated, structurally invalid decoy Received line naming an unrelated IP, and reverse DNS on this host was set to a string that has now appeared identically across at least four unrelated netblocks, indicating an operator-controlled, non-genuine PTR. The message impersonated CarShield with a link to a Google Cloud Storage phishing page that is being reused, byte-for-byte, across multiple sends from different sending infrastructure the same day.
show less
This IP served as the sole genuine SMTP relay for a phishing message, confirmed via SPF/Authenticati ...
show moreThis IP served as the sole genuine SMTP relay for a phishing message, confirmed via SPF/Authentication-Results client-IP alignment. The message carried a structurally invalid, fabricated decoy Received line naming an unrelated third-party IP, and reverse DNS on this host was set to a string that has now been observed identically across at least three unrelated netblocks, indicating an operator-controlled, non-genuine PTR value. The message impersonated a auto-warranty brand (CarShield) with a phishing link to a Google Cloud Storage–hosted landing page, and contained duplicate/malformed Content-Length headers consistent with a known toolkit template bug.
show less
Sending IP for a fake Lowe's/RIDGID prize-giveaway phishing email. SPF confirms this IP as the genui ...
show moreSending IP for a fake Lowe's/RIDGID prize-giveaway phishing email. SPF confirms this IP as the genuine relay for [email protected]. PTR (gigya.mlssoccer.com) is a legitimate customer-identity platform, likely borrowed or compromised for trust-lending. Message contains a fabricated decoy Received line (efianalytics.com [216.244.76.116]) and matches a multi-specimen Family A toolkit pattern, including reuse of the same persistent recipient tracking ID (14327359) across sends.
show less
Sending IP for a prize-survey spam email impersonating Ace Hardware. SPF, DKIM, and DMARC all pass f ...
show moreSending IP for a prize-survey spam email impersonating Ace Hardware. SPF, DKIM, and DMARC all pass for indiansmechamber.com, confirming operator control of the domain. Reverse DNS (215.40.15.51.static.anycast.cnt-grms.ec) falsely presents this Scaleway-hosted IP as Ecuadorian ISP infrastructure. Message-ID format and padding content match a previously reported specimen from the same operator on different Scaleway infrastructure (163.172.188.33) five days earlier, including a byte-identical landing page object.
show less
Sending IP for a phishing email impersonating a cloud storage payment-failure notice. Contains a fab ...
show moreSending IP for a phishing email impersonating a cloud storage payment-failure notice. Contains a fabricated decoy Received line (efianalytics.com [216.244.76.116]) with an unrendered tracking querystring leaked into its id field, spoofed pseudo-Google headers, and placeholder Delivered-To/To values consistent with a toolkit already tracked across multiple prior specimens. PTR (www.nosotros.sancristobal.com.ar) falsely associates the sender with a major Argentine insurance company. Routes to storage.googleapis.com/devilex/devilex1.html.
show less
Unsolicited bulk/affiliate spam email received via Gmail. Envelope mismatch (To: [email protected], actual ...
show moreUnsolicited bulk/affiliate spam email received via Gmail. Envelope mismatch (To: [email protected], actual recipient different) indicates mass BCC blast. Verified sending IP via Google's own trusted Received header (mx.google.com ESMTPS) + matching Received-SPF/DKIM: client-ip=78.135.110.119, rDNS adgame.fruitmail.net. SPF/DKIM pass only because sender controls signing domain otikavhe.adz.aacsb.uk.com (disposable subdomain, free uk.com reseller namespace). Subject: "Tesla Inspired Electric Lighter Selling Out Fast", From: [email protected]. Message contains a fabricated/malformed Received header further down (from efianalytics.com, 216.244.76.116 - no timestamp/by/with/id clauses, i.e. injected decoy, not part of actual delivery path). Body link uses storage.googleapis.com domain-fronting redirect with per-recipient tracking token in URL fragment. Duplicate/malformed Content-Length headers present. Received: Mon 13 Jul 2026 04:33:51 -0700.
show less
IP used as sending infrastructure for a phishing email impersonating a cloud storage billing/account ...
show moreIP used as sending infrastructure for a phishing email impersonating a cloud storage billing/account-suspension notice — third specimen of the same campaign (same GCS payload, same Mailgun container ID 05b6d0824c04, spanning several days). SPF passes for one.bss0012.porsche-cisco.biz.ua, a domain that embeds the Porsche and Cisco trademarks directly. PTR (eiopa-fnp-dev-apim.eurodyn.com) is identical to that seen on a different IP in the same /24 from an earlier specimen, confirming it's a fabricated value maintained across this operator's IP pool. Routes to storage.googleapis.com/hmdbox/hmd-v1-cl4.html.
show less
IP used as sending infrastructure for a phishing email impersonating a cloud storage billing/account ...
show moreIP used as sending infrastructure for a phishing email impersonating a cloud storage billing/account-suspension notice. The envelope address's local part is set to match the recipient's own email username — a self-referential spoofing technique this toolkit uses to make the notice appear personally addressed — under the domain store.bss0011.colaiud.biz.ua (confirmed independently via X-Mailgun-Sending-Ip header). DKIM fails verification; SPF passes for the attacker-controlled domain.
show less
IP used as sending infrastructure for a phishing email impersonating a cloud storage billing/account ...
show moreIP used as sending infrastructure for a phishing email impersonating a cloud storage billing/account-suspension notice — same campaign as a previously reported specimen (same GCS payload, same Mailgun container ID 05b6d0824c04, two days apart). SPF passes and DKIM verifies for the envelope domain store.bss0011.mcdonalds-dhl.biz.ua, which embeds the McDonald's and DHL trademarks directly; the local part is again set to match the recipient's own username. Headers contain three fabricated decoy Received lines spoofing Google, Substack, and Twitter infrastructure. PTR falsely associates the sender with a Motorola Solutions development environment. Routes to storage.googleapis.com/hmdbox/hmd-v1-cl4.html.
show less
Sending IP for unsolicited bulk final-expense insurance advertising email. SPF passes for return@asx ...
show moreSending IP for unsolicited bulk final-expense insurance advertising email. SPF passes for [email protected]. DKIM d=rpufqkjl.asxz.acertub.me, s=smtp, rsa-sha1. Headers contain the same fabricated decoy Received line (efianalytics.com [216.244.76.116]) and duplicate Content-Length header pair (1939/5467) seen in prior specimens from this operator. Reverse DNS (adgame.fruitmail.net) is identical to that seen on a separate, unrelated IP in a different network, confirming this PTR value is deliberately configured across multiple infrastructure pools rather than a genuine per-IP reverse-DNS record. Payload links to storage.googleapis.com/sdghfertytyuuyy/, a bucket also used by two unrelated prior campaigns. Received Fri 2026-07-10.
show less
IP used as sending infrastructure for a phishing email impersonating an iCloud account-lockout/billi ...
show moreIP used as sending infrastructure for a phishing email impersonating an iCloud account-lockout/billing notice. SPF, DKIM, and DMARC all pass for nformedapp.com, confirming operator control of the sending domain. Reverse DNS (163-172-188-33.dynamic-ip.hinet.net) falsely presents this Scaleway-hosted IP as a residential Chunghwa Telecom (Taiwan) connection — Scaleway's own address space is entirely unrelated to HiNet. Payload routes to a credential/payment-detail phishing page on Google Cloud Storage. Received Thu 2026-07-09.
show less
Email SpamPhishing
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.