Prize-scam spam impersonating Netto (Danish) 22 Oct 05:28 UTC from Azure 20.12.212.199, HELO mxuw.Pr ...
show morePrize-scam spam impersonating Netto (Danish) 22 Oct 05:28 UTC from Azure 20.12.212.199, HELO mxuw.PropertyCrest.com (SPF fail), From [email protected] (NXDOMAIN), Reply-To in2.getdrip.com, Message-ID @geopod-ismtpd-4-4. Link brighntpath[.]website (not opened). Ref JF-20261022-452.
show less
Two more casino spam messages 21 Oct 14:29 and 14:49 UTC ("TheSlotz") from Azure 20.169.43.18, HELO ...
show moreTwo more casino spam messages 21 Oct 14:29 and 14:49 UTC ("TheSlotz") from Azure 20.169.43.18, HELO reynolds.social-marketing.ink, From [email protected] (DKIM d=mailboost.site), envelope [email protected], links trust-us.uk (not opened). Refs JF-20261021-418, -423.
show less
Four more casino spam messages 20 Oct 16:00–16:56 UTC ("Wino casino", "Spinzen Casino" fake payout) ...
show moreFour more casino spam messages 20 Oct 16:00–16:56 UTC ("Wino casino", "Spinzen Casino" fake payout) from Azure 20.169.43.18, HELO reynolds.social-marketing.ink, From [email protected] (DKIM d=mailboost.site), envelope [email protected], links trustus-eu.uk (not opened). Refs JF-20261020-325..329.
show less
Repeat casino spam ("Gambiva casino"/WinOlympia) from Azure 20.169.43.18, 35 min after previous repo ...
show moreRepeat casino spam ("Gambiva casino"/WinOlympia) from Azure 20.169.43.18, 35 min after previous report. HELO reynolds.social-marketing.ink, From [email protected] (DKIM d=mailboost.site), envelope [email protected]. Ref JF-20261020-323.
show less
Health-supplement and casino spam (2 messages, 14:31:58 and 18:08:09 UTC, refs JF-20261019-269 and - ...
show moreHealth-supplement and casino spam (2 messages, 14:31:58 and 18:08:09 UTC, refs JF-20261019-269 and -287) from Azure 20.101.83.232, HELO schoen.future-tech.fit, From [email protected] (DKIM d=mailboost.site), envelope [email protected]. Tracking links vertexgroupe.com (not opened). Same operator as earlier Azure IPs 51.124.218.216, 20.101.76.72, 20.169.43.18. Ref JF-20261019-269.
show less
Cloud-storage phishing lure ("Your Cloud ID has been locked...") from Azure 20.110.236.233, HELO 92k ...
show moreCloud-storage phishing lure ("Your Cloud ID has been locked...") from Azure 20.110.236.233, HELO 92k9.weoq5.a.dmarcdutydns.com, forged envelope (SPF fail), no DKIM. Message-ID <[email protected]> (forged). Link: random subdomain of bringyournewproduct.org (not opened). Ref JF-20261019-256.
show less
McAfee-impersonation phishing calendar invite to Hotmail 2026-10-17 20:51:25 UTC, HELO dnaa.serveblo ...
show moreMcAfee-impersonation phishing calendar invite to Hotmail 2026-10-17 20:51:25 UTC, HELO dnaa.serveblog[.]net (No-IP), link oppwer[.]shop. (JF-20261017-188)
show less
Casino spam, From no-reply@mailboost[.]site (Doctorspins), HELO reynolds.social-marketing.ink, repea ...
show moreCasino spam, From no-reply@mailboost[.]site (Doctorspins), HELO reynolds.social-marketing.ink, repeat since 2026-10-03
show less
Advance-fee/package delivery fraud email ('Abandoned Package For Delivery') sent 2026-10-17 01:37 UT ...
show moreAdvance-fee/package delivery fraud email ('Abandoned Package For Delivery') sent 2026-10-17 01:37 UTC from this IP, Reply-To at a third-party mailbox. Ref JF-20261017-167.
show less
Casino spam (Wintino), HELO dibbert.data-pulse.it.com, DKIM mailboost[.]site. 2026-10-17 03:01:26 UT ...
show moreCasino spam (Wintino), HELO dibbert.data-pulse.it.com, DKIM mailboost[.]site. 2026-10-17 03:01:26 UTC.
show less
Casino spam (SpinKong), HELO m7uv.freediving.academy, link domain 4kmedia-market[.]com. 2026-10-16 2 ...
show moreCasino spam (SpinKong), HELO m7uv.freediving.academy, link domain 4kmedia-market[.]com. 2026-10-16 23:48:46 UTC.
show less