[SPAM] American Home Shield ad, repeat abuse on already-listed IP
IP: 205.251.145.34 | Envelope: ...
show more[SPAM] American Home Shield ad, repeat abuse on already-listed IP
IP: 205.251.145.34 | Envelope: aetr.bimorax.biz
DKIM: d=lgfyyigg.aetr.bimorax.biz s=smtp rsa-sha1
Evidence: SPF pass matching Received-SPF client-ip=205.251.145.34,
genuine relay. This is the fourth distinct IP confirmed in the
205.251.145.0/24 block used by this operator (previously .6, .44, .82).
IP already Spamhaus XBL/CBL-listed.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
American Home Shield warranty ad.
Pattern: same DKIM selector/fingerprint as dozens of prior submissions.
show less
[PHISHING] Apple iCloud phishing via Family C toolkit, already-listed IP
IP: 77.90.40.241 | Envel ...
show more[PHISHING] Apple iCloud phishing via Family C toolkit, already-listed IP
IP: 77.90.40.241 | Envelope: one.ass0036.shopifyxiaomi.biz.ua
DKIM: d=Gtgp.one.ass0036.shopifyxiaomi.biz.ua s=mail rsa-sha1
Evidence: SPF pass matching Received-SPF client-ip=77.90.40.241,
genuine relay — verified against fabricated decoy hops (fake Substack,
Twitter, and Docker-style Received lines all present but structurally
invalid). PTR (dfusion.toms.com, TOMS brand) trust-borrowed, unrelated
to sender. IP already Spamhaus XBL/CBL-listed.
Payload: storage.googleapis.com/strow/strw_v2.html
Apple iCloud phishing — first confirmed instance of this lure on this
bucket, which previously only served a cloud-billing-notice lure,
confirming it too is a multi-purpose loader object.
Pattern: distinct DKIM selector (s=mail) and fabricated header set
identifies this as a separate toolkit variant ("Family C") from the
majority of this campaign's specimens (s=smtp).
show less
[SPAM] Fake YETI Beach Lounge Wagon prize scam, new lure variant
IP: 46.8.182.43 | Envelope: asws ...
show more[SPAM] Fake YETI Beach Lounge Wagon prize scam, new lure variant
IP: 46.8.182.43 | Envelope: asws.cejita.me
DKIM: d=idsjbwtd.asws.cejita.me s=smtp rsa-sha1
Evidence: SPF pass matching Received-SPF client-ip=46.8.182.43, genuine
relay. Adjacent to two other IPs in this small block already flagged in
this campaign (46.8.182.44, 46.8.182.46 — the latter already XBL-listed).
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
New lure variant: fake "YETI Beach Lounge Wagon" prize scam (previously
only "YETI Patriotic Bundle" documented on this loader).
Pattern: same injector fingerprint as dozens of prior submissions.
show less
[SPAM] Fake life insurance ad, new brand-borrowed PTR
IP: 74.48.56.129 | Envelope: eftg.proinitia ...
show more[SPAM] Fake life insurance ad, new brand-borrowed PTR
IP: 74.48.56.129 | Envelope: eftg.proinitiative.biz
DKIM: d=cpoodqeo.eftg.proinitiative.biz s=smtp rsa-sha1
Evidence: SPF pass matching Received-SPF client-ip=74.48.56.129,
genuine relay. PTR (ladyactive.clarins.com) belongs to Clarins, a
legitimate cosmetics brand, trust-borrowed and unrelated to this sender.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
Ethos life insurance affiliate ad.
Pattern: same injector fingerprint as this campaign's other Clarins-PTR
IPs; virgin on Spamhaus SBL/XBL/PBL.
show less
[SPAM] DirectMeds pharma ad, repeat abuse on already-listed IP
IP: 46.8.182.46 | Envelope: asxz.s ...
show more[SPAM] DirectMeds pharma ad, repeat abuse on already-listed IP
IP: 46.8.182.46 | Envelope: asxz.sumiamp.me
DKIM: d=btrpigup.asxz.sumiamp.me s=smtp rsa-sha1
Evidence: SPF pass matching Received-SPF client-ip=46.8.182.46, genuine
relay. IP already Spamhaus XBL/CBL-listed; this adds corroborating
evidence of continued active abuse from the same operator toolkit.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
DirectMeds GLP-1/weight-loss pharma affiliate ad on the campaign's
primary multi-purpose loader.
Pattern: same DKIM selector/fingerprint as dozens of prior submissions
on this loader object.
show less
[SPAM] Fake American Home Shield warranty ad, mass campaign
IP: 205.251.145.44 | Received: Sat, 0 ...
show more[SPAM] Fake American Home Shield warranty ad, mass campaign
IP: 205.251.145.44 | Received: Sat, 04 Jul 2026 12:14:57 -0700
Envelope: [email protected]
DKIM: d=cavkqhkp.deqe.vexowinner.biz s=smtp rsa-sha1
Message-ID: <ejifiqemmwnjembolskbwniffwjxem@0ivia2vy43prps7mr2>
Evidence: SPF pass recorded by mx.google.com for this envelope at this
IP/timestamp (Received-SPF client-ip=205.251.145.44 matches). Verified
relay, not spoofed.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
Fake American Home Shield warranty ad on the campaign's primary
multi-purpose loader object, now confirmed serving at least 8 distinct
lure types.
Pattern: third distinct IP in the 205.251.145.0/24 block used by this
operator (previously .34, .6, .82); same DKIM selector and injector
fingerprint as 12+ prior submissions.
show less
[SPAM] Fake CNN-branded health affiliate ad, mass campaign
IP: 46.8.182.44 | Received: Sat, 04 Ju ...
show more[SPAM] Fake CNN-branded health affiliate ad, mass campaign
IP: 46.8.182.44 | Received: Sat, 04 Jul 2026 10:41:56 -0700
Envelope: [email protected]
DKIM: d=wksqyqci.asde.bandawareness.me s=smtp rsa-sha1
Message-ID: <frbouepmbsiivtywljjxdygytyfkdt@e6x1q95ul3inrjrv5t>
Evidence: SPF pass recorded by mx.google.com for this envelope at this
IP/timestamp (Received-SPF client-ip=46.8.182.44 matches). Verified
relay, not spoofed.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
Fake CNN-branded "60 Minutes"-style video segment promoting CoreRelief
joint pain supplement with fabricated doctor endorsement.
Pattern: adjacent IP block to a previously SBL-listed IP in this
campaign (46.8.182.46); shares the DKIM selector and injector
fingerprint documented across 10+ prior submissions on this same GCS
payload object.
show less
[SPAM] Fake Sam's Club prize notification, repeat delivery
IP: 178.170.116.90 | Received: Sat, 04 ...
show more[SPAM] Fake Sam's Club prize notification, repeat delivery
IP: 178.170.116.90 | Received: Sat, 04 Jul 2026 00:49:27 -0700
Envelope: [email protected]
DKIM: d=qkivemha.aes.aferzint.biz s=smtp rsa-sha1
Message-ID: <qmzsnizigrwkybkxyeunojxsitjflz@4j4py6qhti9txkw97b>
Evidence: SPF pass recorded by mx.google.com for this envelope at this
IP/timestamp (Received-SPF client-ip=178.170.116.90 matches). Verified
relay, not spoofed.
Payload: storage.googleapis.com/ousjasdsakhsgg/dsfdgdfgdseewe.html
Fake Sam's Club Member's Mark prize notification, byte-for-byte repeat
of previously submitted specimens using this same IP and object.
Pattern: third confirmed use of this exact IP in this campaign;
this IP's PTR has previously been observed under different hostname
assignments, confirming reassignment over time.
show less
[SPAM] Fake retail prize notification, mass campaign
IP: 81.181.129.212 | Received: Sat, 04 Jul 2 ...
show more[SPAM] Fake retail prize notification, mass campaign
IP: 81.181.129.212 | Received: Sat, 04 Jul 2026 01:22:54 -0700
Envelope: [email protected]
DKIM: d=oagpuzjt.google.novarixstudio.de s=smtp rsa-sha1
Message-ID: <njzsqgzhnxspjbktznikdcpbdvlkgb@4c7jygnfzs9zluz30u14327359-6>
Evidence: SPF pass recorded by mx.google.com for this envelope at this
IP/timestamp (Received-SPF client-ip=81.181.129.212 matches). Verified
relay, not spoofed. PTR (bottlegame.uol.com.br) belongs to UOL, a major
Brazilian internet portal, trust-borrowed and unrelated to this sender.
Payload: storage.googleapis.com/bobalomaniaz/bazonamolapa.html
Fake Tractor Supply/YETI Outdoor Bundle prize notification impersonating
a genuine seasonal YETI product line.
Pattern: envelope domain follows the campaign's google.[x].[tld]
typosquat convention; persistent recipient ID 14327359 embedded, linking
to a previously documented shared list segment.
show less
[SPAM] Fake life insurance affiliate ad, mass campaign
IP: 205.251.145.6 | Received: Sat, 04 Jul ...
show more[SPAM] Fake life insurance affiliate ad, mass campaign
IP: 205.251.145.6 | Received: Sat, 04 Jul 2026 00:25:04 -0700
Envelope: [email protected]
DKIM: d=kmnpteuq.ertd.emboxy.me s=smtp rsa-sha1
Message-ID: <ccluepntgqkjpbkodbrgdcofvrtyhe@s3nk398drocgntvlzq>
Evidence: SPF pass recorded by mx.google.com for this envelope at this
IP/timestamp (Received-SPF client-ip=205.251.145.6 matches). Verified
relay, not spoofed.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
Ethos-branded life insurance affiliate ad served by the same object
confirmed hosting Apple iCloud phishing elsewhere in this campaign.
Pattern: same /24 block as previously submitted IPs in this campaign
(205.251.x.x range); shared DKIM selector and injector fingerprint
across 10+ prior submissions.
show less
[PHISHING] Apple iCloud credential-harvest, mass campaign
IP: 217.195.202.225 | Received: Sat, 04 ...
show more[PHISHING] Apple iCloud credential-harvest, mass campaign
IP: 217.195.202.225 | Received: Sat, 04 Jul 2026 00:24:33 -0700
Envelope: [email protected]
DKIM: d=iaxwmocf.adcv.horyvex.me s=smtp rsa-sha1
Message-ID: <jkiaaeguelwkojmugkdicstiiuretn@6dnxwzvoqhhxw3k4es>
Evidence: SPF pass recorded by mx.google.com for this envelope at this
IP/timestamp (Received-SPF client-ip=217.195.202.225 matches). Verified
relay, not spoofed.
Payload: storage.googleapis.com/sdghfertytyuuyy/serksmhajdjddjd.html
Fake Apple account-suspension notice harvesting Apple ID credentials via
fabricated Subscription ID and same-day expiry urgency.
Pattern: same /24 block as a previously submitted relay IP in this
campaign (217.195.202.223); matches the established rotating-domain,
shared-DKIM-selector pattern documented across 10+ prior submissions.
show less
Genuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF ...
show moreGenuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF client-ip=. PTR: adgame.fruitmail.net (this
IP has been observed with drifting PTR assignments over time). Envelope
domain: aes.alkorzen.biz. DKIM: s=smtp, rsa-sha1. Payload: GCS bucket
ousjasdsakhsgg/dsfdgdfgdseewe.html — fake Sam's Club prize notification,
exact repeat of a previously reported specimen. Virgin on Spamhaus
SBL/XBL/PBL.
show less
Genuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF ...
show moreGenuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF client-ip=. This IP is already Spamhaus
XBL/CBL-listed. PTR has drifted from a previously-observed Macy's
customer-service PTR to adgame.fruitmail.net, confirming PTR
reassignment over time on recurring IPs in this campaign. Envelope
domain: aetr.bormixa.biz (already Spamhaus DBL-listed). Payload: GCS
bucket sdghfertytyuuyy/serksmhajdjddjd.html — confirmed multi-campaign
loader (American Home Shield warranty scam lure in this instance).
show less
Genuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF ...
show moreGenuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF client-ip=. PTR: adgame.fruitmail.net. This
IP is already Spamhaus XBL/CBL-listed; this report adds corroborating
evidence: envelope domain adsx.yorelvn.biz, DKIM s=smtp rsa-sha1,
payload via GCS bucket ousjasdsakhsgg (fake Harvard Health/Alzheimer's
supplement lure — exact repeat of a previously reported specimen).
show less
Genuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF ...
show moreGenuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF client-ip= and Authentication-Results. PTR:
www.campaign.rinascente.it (La Rinascente, Italian luxury department
store) — trust-borrowed at the SMTP layer, unrelated to this send.
Envelope domain: google.primesystemmaxprodo.biz.id. DKIM: s=smtp,
rsa-sha1. Payload: GCS bucket bobalomaniaz/bazonamolapa.html — fake
Lowe's/RIDGID prize scam, reusing an object previously confirmed serving
a different lure type (YETI/Ace Hardware). Message contains fabricated
decoy Received header ("efianalytics.com") to misdirect analysts.
Virgin on Spamhaus SBL/XBL/PBL.
show less
Genuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF ...
show moreGenuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF client-ip=. PTR: m.customerservice.macys.com
— Macy's customer service PTR trust-borrowed at the SMTP layer; this is
a new IP within a previously documented Macy's-PTR IP range used by this
operator (previously seen: 205.251.145.34). Envelope domain:
ergr.onlynewsroom.biz. Payload: GCS bucket sdghfertytyuuyy (confirmed
multi-campaign loader — life insurance ad in this send). Virgin on
Spamhaus SBL/XBL/PBL.
show less
Genuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF ...
show moreGenuine, verified spam-sending host — confirmed via complete Received
header matching Received-SPF client-ip=. PTR: adgame.fruitmail.net
(recurring hostname across multiple IPs in this campaign cluster). This
IP is already Spamhaus SBL-listed (127.0.0.3); this report adds
corroborating evidence: envelope domain asxz.torweep.me, DKIM s=smtp
rsa-sha1, payload via GCS bucket sdghfertytyuuyy (confirmed
multi-campaign loader — pharma/weight-loss lure in this send).
show less
Email SpamPhishing
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.