Observed an unsolicited spam email originating from IP address 74.50.50.133 on October 13, 2026, at ...
show moreObserved an unsolicited spam email originating from IP address 74.50.50.133 on October 13, 2026, at 19:16:29 CEST (UTC+2).
The message originated from [email protected] and impersonated AAA, promoting a misleading complimentary vehicle emergency kit offer.
The source IP was confirmed through SMTP Received headers added by the receiving mail infrastructure. SPF passed, explicitly authorizing 74.50.50.133 to send email for zippyvaleuu.bond.
The message shares distinctive indicators with an ongoing spam campaign involving multiple sending domains and hosting providers, including the same physical mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), similar promotional templates, and an identical tracking pixel identifier.
The original email, including its complete SMTP headers, was submitted to RimuHosting at [email protected] on October 13, 2026. Delivery confirmation is pending.
This report covers one newly observed incident.
show less
Observed an unsolicited spam email originating from IP address 46.36.35.12 on October 13, 2026, at 1 ...
show moreObserved an unsolicited spam email originating from IP address 46.36.35.12 on October 13, 2026, at 18:08:01 CEST (UTC+2).
The message originated from [email protected] and used the Omaha Steaks brand to promote a misleading complimentary steak sampler offer.
The source IP was confirmed through SMTP Received headers added by the receiving mail infrastructure. SPF passed, explicitly authorizing 46.36.35.12 to send email for zealousmoonrv.bond.
The message shares distinctive indicators with an ongoing spam campaign involving multiple sending domains and hosting providers, including the same physical mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), similar promotional templates, and an identical tracking pixel identifier.
The original email, including its complete SMTP headers, was sent to the RIPE-listed abuse contact, [email protected], on October 13, 2026. Delivery confirmation is pending.
This report covers one newly observed incident.
show less
Observed an unsolicited spam email originating from IP address 5.83.45.186 on October 13, 2026, at 1 ...
show moreObserved an unsolicited spam email originating from IP address 5.83.45.186 on October 13, 2026, at 16:03:15 CEST (UTC+2).
The message originated from [email protected] and impersonated Life Line Screening, promoting an unsolicited health screening offer.
The source IP was confirmed through SMTP Received headers added by the receiving mail infrastructure. SPF passed, explicitly authorizing 5.83.45.186 to send email for strongbranchuf.bond.
The message shares distinctive indicators with an ongoing spam campaign involving multiple sending domains and hosting providers, including the same physical mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), similar promotional templates, and an identical tracking pixel identifier.
The original email, including its complete SMTP headers, was submitted to the RIPE-listed abuse contact, [email protected], on October 13, 2026. Delivery confirmation is pending.
show less
Observed an unsolicited spam email originating from IP address 103.85.28.70 on October 11, 2026, at ...
show moreObserved an unsolicited spam email originating from IP address 103.85.28.70 on October 11, 2026, at 17:50:14 CEST (UTC+2).
The message used the sending domain stellarledgewo.bond and impersonated AAA, promoting a misleading complimentary vehicle emergency kit offer.
The source IP was confirmed through SMTP Received headers added by the receiving mail infrastructure. SPF passed, explicitly authorizing 103.85.28.70 for stellarledgewo.bond.
The message shares recurring indicators with an ongoing spam campaign, including similar promotional templates, the mailing address 30 N Gould St., Ste N, Sheridan, WY 82801, and tracking identifiers.
The same sending domain has also been observed distributing similar unsolicited messages from 82.118.16.100, 65.98.5.186, and 185.115.141.48.
The incident was reported to the APNIC-listed abuse contact, [email protected], on October 12, 2026.
show less
Additional unsolicited spam activity observed from IP address 185.115.141.48 on October 12, 2026, at ...
show moreAdditional unsolicited spam activity observed from IP address 185.115.141.48 on October 12, 2026, at 00:54:26 CEST (October 11, 22:54:26 UTC).
The message originated from [email protected] and impersonated Harbor Freight, promoting a misleading complimentary Predator Generator offer.
The source IP was confirmed through SMTP Received headers added by the receiving mail infrastructure. SPF passed, explicitly authorizing 185.115.141.48 for stellarledgewo.bond.
This is the third sending domain observed using this IP in the ongoing campaign, following snowythicketgh.pro and vintagepetalwt.bond.
The message shares recurring indicators with previously documented spam, including the mailing address 30 N Gould St., Ste N, Sheridan, WY 82801, and an identical tracking pixel identifier.
This report covers one new incident not included in my previous AbuseIPDB report of October 11, 2026.
show less
Additional unsolicited spam activity observed from IP address 65.98.5.186 on October 11, 2026, at 17 ...
show moreAdditional unsolicited spam activity observed from IP address 65.98.5.186 on October 11, 2026, at 17:06:24 CEST (UTC+2).
The message originated from [email protected] and impersonated AAA, promoting a misleading complimentary vehicle emergency kit offer.
The source IP was confirmed through SMTP Received headers added by the receiving mail infrastructure. SPF passed, explicitly authorizing 65.98.5.186 for stellarledgewo.bond.
The receiving mail infrastructure flagged the message as suspicious (X-Spam-Flag: YES).
The email shares recurring campaign indicators with previously documented unsolicited messages, including similar promotional templates, the same mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), and an identical tracking pixel identifier.
This report covers one new incident not included in my previous AbuseIPDB report of October 11, 2026.
show less
Additional unsolicited spam activity observed from IP address 148.135.22.240 on October 11, 2026, at ...
show moreAdditional unsolicited spam activity observed from IP address 148.135.22.240 on October 11, 2026, at 16:46:04 CEST (UTC+2).
The message originated from [email protected] and impersonated AAA, promoting a misleading complimentary vehicle emergency kit offer.
The source IP was confirmed through SMTP Received headers added by the receiving mail infrastructure. SPF passed, explicitly authorizing 148.135.22.240 for dreamypondsf.bond.
Notably, the same sending domain was previously observed distributing similar spam from another IP address, 65.98.5.186, indicating rotation of sending infrastructure.
The message contains recurring campaign indicators, including the mailing address 30 N Gould St., Ste N, Sheridan, WY 82801, and the same tracking pixel identifier.
This report covers one new incident not included in my previous AbuseIPDB report of October 11, 2026.
show less
Observed an unsolicited spam email originating from IP address 82.118.16.100 on October 11, 2026, at ...
show moreObserved an unsolicited spam email originating from IP address 82.118.16.100 on October 11, 2026, at 15:52:14 CEST (UTC+2).
The message used the sending domain stellarledgewo.bond and impersonated AAA, promoting a misleading complimentary emergency car kit offer.
It shares distinctive characteristics with a broader spam campaign, including the same physical mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), similar promotional content, and recurring tracking identifiers.
The email also contains a substantial amount of unrelated narrative text embedded in its body, potentially intended to influence spam filtering.
The source IP was verified from SMTP Received headers added by the receiving mail infrastructure.
An abuse report containing the original email message and complete SMTP headers was submitted to the RIPE-listed abuse contact ([email protected]) on October 11, 2026.
show less
Observed an unsolicited spam email originating from IP address 65.98.5.186 on October 11, 2026, at 1 ...
show moreObserved an unsolicited spam email originating from IP address 65.98.5.186 on October 11, 2026, at 15:19:19 CEST (UTC+2).
The message used the sending domain dreamypondsf.bond and impersonated Costco, promoting a misleading complimentary HexClad cookware offer.
It shares distinctive indicators with a broader spam campaign, including the same mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), similar promotional templates, and an identical tracking pixel identifier.
The source IP was verified from SMTP Received headers added by the receiving mail infrastructure.
An abuse report containing the original email message and complete SMTP headers was submitted to [email protected] on October 11, 2026.
Another IP in the same provider's 65.98.5.0/24 network, 65.98.5.248, has also been observed distributing messages with matching campaign indicators.
show less
Observed two unsolicited spam emails originating from IP address 5.11.83.66 on October 11, 2026, at ...
show moreObserved two unsolicited spam emails originating from IP address 5.11.83.66 on October 11, 2026, at 01:14:58 and 03:01:23 CEST (UTC+2).
Both messages used the sending domain golddeltaav.com and impersonated Harbor Freight and AAA, promoting misleading complimentary product offers.
The emails share distinctive indicators with a broader ongoing spam campaign, including similar promotional templates, the same physical mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), and an identical tracking pixel identifier.
The source IP was identified from SMTP Received headers added by the receiving mail infrastructure.
An abuse report containing both original email messages and complete SMTP headers was submitted to [email protected] on October 11, 2026
show less
Observed two unsolicited spam emails originating from IP address 185.115.141.48 on October 10–11, 20 ...
show moreObserved two unsolicited spam emails originating from IP address 185.115.141.48 on October 10–11, 2026 (CEST, UTC+2).
The messages used two different sending domains:
- snowythicketgh.pro – October 10, 05:45 CEST.
- vintagepetalwt.bond – October 11, 16:34 CEST.
Both messages belong to an apparent coordinated spam campaign involving rotating sending domains and misleading promotional offers impersonating legitimate businesses, including Life Line Screening.
Recurring indicators include similar email structures, the same physical mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), and an identical tracking pixel identifier.
The sending IP was verified from SMTP Received headers added by the receiving mail infrastructure.
Abuse reports with original email evidence were sent to [email protected] on October 10 and 11, 2026.
show less
Observed an unsolicited spam email originating from IP address 37.221.215.66 on October 9, 2026, at ...
show moreObserved an unsolicited spam email originating from IP address 37.221.215.66 on October 9, 2026, at 18:51:35 CEST (UTC+2).
The message used the sending domain crystalboxle.com and impersonated Life Line Screening, promoting an unsolicited health screening offer.
It shares distinctive characteristics with a broader ongoing spam campaign, including similar promotional templates, the same physical mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), and recurring tracking identifiers.
The source IP was identified from SMTP Received headers added by the receiving mail infrastructure.
An abuse report containing the original email message and its complete SMTP headers was sent to the hosting provider's abuse contact ([email protected]) on October 9, 2026.
show less
Observed two unsolicited spam emails originating from IP address 77.83.103.239 on October 9, 2026, a ...
show moreObserved two unsolicited spam emails originating from IP address 77.83.103.239 on October 9, 2026, at approximately 18:35 and 19:07 CEST (UTC+2).
Both messages used the sending domain kindquartzpy.com and impersonated Harbor Freight and Life Line Screening, promoting misleading offers.
The emails share characteristics with a broader ongoing spam campaign, including similar promotional templates, recurring mailing address details, and an identical tracking pixel identifier found in messages originating from other IP addresses.
The source IP was identified from SMTP Received headers added by the receiving mail infrastructure.
An abuse report with both original email messages, including their complete SMTP headers, was submitted to the hosting provider's abuse contact ([email protected]) on October 9, 2026.
show less
Observed an unsolicited spam email originating from IP address 185.203.18.38 on October 8, 2026, at ...
show moreObserved an unsolicited spam email originating from IP address 185.203.18.38 on October 8, 2026, at 23:29:03 CEST (UTC+2).
The message used the sending domain coolpinesd.blog and impersonated Costco, promoting a misleading complimentary product offer.
It shares distinctive characteristics with a broader spam campaign, including recurring promotional templates, the physical mailing address 30 N Gould St., Ste N, Sheridan, WY 82801, and an identical tracking pixel identifier found in spam messages originating from other IP addresses.
The source IP was identified from SMTP Received headers added by the receiving mail infrastructure.
An abuse report containing the original email evidence was submitted to the hosting provider's abuse contact ([email protected]) on October 9, 2026.
show less
Observed 5 unsolicited spam emails originating from 148.135.22.240 between October 8 and 11, 2026 (C ...
show moreObserved 5 unsolicited spam emails originating from 148.135.22.240 between October 8 and 11, 2026 (CEST, UTC+2).
Sending domains:
- steadybreezeah.bond: 2 messages (October 8).
- feathershipnu.com: 1 message (October 9).
- petitetwigmv.com: 2 messages (October 11).
Messages used misleading promotional offers impersonating AAA, Omaha Steaks, Life Line Screening and Lowe's.
The emails share recurring indicators, including the same mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), similar HTML templates and an identical tracking pixel identifier.
The source IP was verified using SMTP Received headers from the receiving mail servers.
Abuse reports were submitted to the RIPE-listed contact, [email protected], on October 9–10, but rejected by its mail filtering system (SMTP 550 5.7.1). Reports were subsequently sent to [email protected] on October 10–11, 2026.
show less
Observed 44 unsolicited bulk emails originating from 65.98.5.248 on October 9–10, 2026 (CEST, UTC+2) ...
show moreObserved 44 unsolicited bulk emails originating from 65.98.5.248 on October 9–10, 2026 (CEST, UTC+2). The sending domains were angelicbasevz.com (42 messages), hazyhavenfr.pro (1 message), and rubydunehw.pro (1 message).
Messages impersonated brands including Costco, Lowe's, AAA, Harbor Freight and Life Line Screening, promoting misleading complimentary product offers.
All messages shared recurring campaign indicators, including similar HTML structures, the same mailing address (30 N Gould St., Ste N, Sheridan, WY 82801), and an identical tracking pixel identifier.
The source IP was identified from SMTP Received headers added by the receiving mail infrastructure. Abuse reports were submitted to the hosting provider, WHG Hosting Services Ltd, on October 9–10, 2026.
show less
Email Spam
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.