Fake email spoofing โโโโโ@amazon.com claiming that my "organisation" qualifies for a "business accou ...
show moreFake email spoofing โโโโโ@amazon.com claiming that my "organisation" qualifies for a "business account with Amazon". The email appears to exploit the amazonses.com domain. Though the sender claims to work for amazon.co.uk and uses British English, email data shows it was actually sent from: Sao Paulo, Brazil. The fact remains that I do not qualify for a "business account with Amazon" because I am not a seller with Amazon, do not earn enough to pay TAX nor qualify for registered VAT status.
show less
Fake email from โโโโโ.lakeside-services.com and โโโโโ@mail.com attempting to steal passwords. Claim ...
show moreFake email from โโโโโ.lakeside-services.com and โโโโโ@mail.com attempting to steal passwords. Claim that password from webmail will expire a date several weeks before the email received and spoofing my domain name in From field.
show less
Fake email from โโโโโ.lakeside-services.com and โโโโโ@mail.com attempting to steal passwords. Claim ...
show moreFake email from โโโโโ.lakeside-services.com and โโโโโ@mail.com attempting to steal passwords. Claim that password from webmail will expire a date several weeks before the email received and spoofing my domain name in From field.
show less
Attempting to send spam emails under my email address. Both dkim and spf fail; emails spoofing my em ...
show moreAttempting to send spam emails under my email address. Both dkim and spf fail; emails spoofing my email/domain were rejected by corp.mail.ru.
show less
Multiple fake email claiming to be from "Server Team Management" with a malicious link to apparently ...
show moreMultiple fake email claiming to be from "Server Team Management" with a malicious link to apparently "fix" the issue. Sender from server.j3redmarketing.com; โโโ@haycreekranch.net; โโโ@eurostar.lv; papa.de.hostns.io.
[Content]
Dear โโโโโ, Request to delete your account has been received; request is under process. If the request was made in error and you are not aware, Log in and cancel the request now (button: Cancel Deactivation Request On โโโโโ)
show less
Multiple fake "Messages Failed Report" claiming to be from the System Administrator with a malicious ...
show moreMultiple fake "Messages Failed Report" claiming to be from the System Administrator with a malicious link to apparently "fix" the issue. I am the System Administrator so this is clearly a phishing attack. Sender from server.j3redmarketing.com; โโโ@haycreekranch.net; โโโ@eurostar.lv; papa.de.hostns.io.
[Content]
An email you sent was not successfully delivered to (5) intended recipients. The error usually indicates that the recipient's email server rejected the message. CLICK HERE to review recipients, fix failed email deliveries and prevent future issues. Note: Please verify you are not a robot and not auto-generated. System Administrator โโโโโ
show less
Threat/hate mail. Reported to police.
User Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_1 like ...
show moreThreat/hate mail. Reported to police.
User Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.3 Mobile/15E148 Safari/604.1
IP: Likely VPN tunnelled through a VPS (194.35.235.224)
show less
Email spam through web contact form.
----------
FROM: (REDACTED)@outpush.io
SUBJECT: Discover pus ...
show moreEmail spam through web contact form.
----------
FROM: (REDACTED)@outpush.io
SUBJECT: Discover push notifications ads
CONTENT:
Hello,
Have you ever thought about web push notifications to communicate with visitors on (REDACTED)?
At outpush.io, we developed a free solution that is much more efficient than email... About 75% of openings on each campaign!
On top of that, we send personalized advertising in pushes allowing you to earn additional income, without doing anything.
Want to talk about it for (REDACTED)?
Have a great day,
(REDACTED)
Co-founder @ outpush.io
Let's talk: https://calendly.com/(REDACTED)
show less
COMMENT: Multiple aggressive malicious threats from user for payment of fake domain expiry notice
( ...
show moreCOMMENT: Multiple aggressive malicious threats from user for payment of fake domain expiry notice
(REDACTED = Our related domain names)
[CONTENT START]
FROM: Joe Miller <[email protected]>
YOUR IMMEDIATE ATTENTION TO THIS MESSAGE IS ABSOLUTELY NECESSARY!
YOUR DOMAIN (REDACTED) WILL BE TERMINATED WITHIN 24 HOURS
We have not received your payment for the renewal of your domain (REDACTED)
We have made several attempts to reach you by phone, to inform you regarding the TERMINATION of your domain (REDACTED)
CLICK HERE FOR SECURE ONLINE PAYMENT: http://yourdomainclinical.xyz/?n=(REDACTED)&r=a&t=1607773992&p=v1
IF WE DO NOT RECEIVE YOUR PAYMENT WITHIN 24 HOURS, YOUR DOMAIN (REDACTED) WILL BE TERMINATED
CLICK HERE FOR SECURE ONLINE PAYMENT: http://yourdomainclinical.xyz/?n=(REDACTED)&r=a&t=1607773992&p=v1
ACT IMMEDIATELY.
The submission notification (REDACTED) will EXPIRE WITHIN 24 HOURS after reception of this email
[/CONTENT START]
show less
Fake Netflix account deactivation message about failed subscription payment. domains (REDACTED)@wpkb ...
show moreFake Netflix account deactivation message about failed subscription payment. domains (REDACTED)@wpkb.inixgzjgxwa.us and (REDACTED)@www.7158rr.com designates 159.253.47.172 as permitted senders, passed SPF with 159.253.47.172, spoofed "to" header as [email protected]; uses links to fake webpage to steal personal data "https://storage.googleapis.com/wingoodsnwessserverone/ackgrounderche.html#(REDACTED)" (Note: hash has been redacted to protect other users)
show less
Extensive (2,000+) requests to access random root level php files (random filenames containing a sin ...
show moreExtensive (2,000+) requests to access random root level php files (random filenames containing a single and double letters and numbers) that don't exist including known non-server related system filenames that also do not exist.
show less
Exstensive number of attempts to locate a non-existant "wp-login.php" file in different directories' ...
show moreExstensive number of attempts to locate a non-existant "wp-login.php" file in different directories' of domain.
show less
Fake PayPal money request from "{redacted}@grossdrakeassociates.onmicrosoft.com" with username "work ...
show moreFake PayPal money request from "{redacted}@grossdrakeassociates.onmicrosoft.com" with username "worker14@GrossDrakeAssociates". [No such request was made on PayPal itself and does not appear in PayPal Activity]. Appears to be sent via Outlook but passes SPF/DKIM/DMARC checks of both Microsoft and PayPal.
show less
False claim of expired Netflix account (non-existant) with phishing link from "{redacted}@olvlv.yusz ...
show moreFalse claim of expired Netflix account (non-existant) with phishing link from "{redacted}@olvlv.yusznpxknuqw.com"/ ID: "{uuid}[email protected]" / "mc.hkcdc.org" and "hinet-ip.hinet.net" as permitted senders. Return path: vlytdmhpbkex.com / tfqdtaqvikmr.us / Loop: tfloydeooajt.com / Carbon Copy: qvrjayimdfqa.com
show less
webmail spam claiming to be from Netflix, that our (non-existent) account has expired and asking to ...
show morewebmail spam claiming to be from Netflix, that our (non-existent) account has expired and asking to complete a short survey to get extra subscription extention. Link uses a "tinyurl.com" endpoint to a malicious webpage. from domain(s) cctv.giraffedigital.co.uk and hinet-ip.hinet.net as permitted senders.
show less
Fake email from "{redacted}@mail-top.asia" claiming our webmail accounts will be blocked unless clic ...
show moreFake email from "{redacted}@mail-top.asia" claiming our webmail accounts will be blocked unless clicking on a link (attempt to steal personal information and install malware). Offending headers: papa.de.hostns.io with LMTP / 95.213.165.242:56619
show less
Fake email from "{redacted}@mail-top.asia" claiming our webmail accounts will be blocked unless clic ...
show moreFake email from "{redacted}@mail-top.asia" claiming our webmail accounts will be blocked unless clicking on a link (attempt to steal personal information and install malware). Offending headers: apa.de.hostns.io with LMTP / 95.213.165.242:56619
show less
papa.de.hostns.io / daf6cfbaf2.nxcli.io / cloudhost-10969997.us-midwest-2.nxcli.net ~ fake email spo ...
show morepapa.de.hostns.io / daf6cfbaf2.nxcli.io / cloudhost-10969997.us-midwest-2.nxcli.net ~ fake email spoofing our email address as sender from "{redacted}@2fa.io" claiming to be server admin that our website and accounts have been disabled and wanting to verify 2FA data.
show less
fake email using our spoofing email address as sender from "{redacted}@2fa.io" claiming to be server ...
show morefake email using our spoofing email address as sender from "{redacted}@2fa.io" claiming to be server admin that our website and accounts have been disabled and wanting to verify 2FA data. ~ papa.de.hostns.io / daf6cfbaf2.nxcli.io / cloudhost-10969997.us-midwest-2.nxcli.net
show less
PhishingEmail SpamSpoofing
By clicking โAccept allโ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.