This is spam

These are e-mail addresses that sent spam/scam/phishing emails to me.

If you received an email from one of these addresses or asking you to write to one of them - that's a scam and you should ignore and delete their message. Messages from the addresses below were rejected by my spam filter.

Explanation of columns:

• host — which of my servers the message arrived on:

  • ams has priority 10,
  • msk has priority 20,

• spamby - which of used services reported the message as spam, rbldns.ru or rhsbl.shpakovsky.ru. Note that rhsbl gets checked first, so this column sholud not be used to compare performance of these two services. It can be used to evaluate performance of rhsbl service alone, though - but you might need to take into account spam mail which got past my spam filter, which is not show in this table.

• from — email address the message is claiming to be from. Note that it might be spoofed, i.e. malicious sender can simply put someone else's address here, so don't trust this blindly.

• helo — how sender (server) application introduced itself

• ip — sender’s IP address

• ptr — the reverse DNS entry corresponding to this IP. This field is empty when ip address doesn't have a PTR record.

• ptr_match — whether the PTR resolves back to the same IP: 1=yes, 0=no.

• helo_match - whether helo matches ptr

• from_ip - A or MX record of the sender’s domain (from_host column) points to sender's IP.

• spf — whether the message passed SPF validation. Hovering this field might show a tooltip with SPF record.

• co — the country where the sender’s IP address is located

• asn — the network (ASN) the IP address belongs to

• from_host – the sender’s domain (domain of e-mail address specified in the "from" field). Note that it may be spoofed, so this should be considered only if SPF = pass or if it matches the domain specified in the PTR record and "ptr_match" is 1. To help you, this column also includes confidence rating:

  • bronze medal if there are signs that from_host is related to sender's ip: either ptr_match and ptr equals to from_host or one is subdomain of another, or from_ip column is 1
  • silver medal if SPF passes,
  • gold medal if SPF passes and one of "good mailer" signs is true: either ptr_match or helo_match is 1
  • golden trophy SPF passes and both of "good mailer" signs are true.
  • red "stop" and "prohibited" signs show hard and soft SPF failures respectively, what is a good indicator that sender domain was likely spoofed;
  • yellow warning sign means that domain doesn't have an SPF record, what in modern world probably means that they don't expect to send email (because anyone sending email in year 2025 will inevitably learn about SPF existence, one way or another).

  Note that here "high confidence" (gold medal or trophy) means "bad domain" (i.e. domain belongs to spamers), while "low confidence" (red signs) mean "innocent domain" (i.e. spamers impersonate otherwise good domain). Don't get confused and don't go after innocent domains. Nobody likes Internet vigilanties who are wrong! Better go read blog post by Daniel, author of curl.

• rhsbl – indicates whether the sender’s domain is blocked by my rhsbl service, and if so, until what date.

• registered — the registration date of the sender's domain

• expires — domain expiration date

• registrar — domain registrar, with an abuse address if available. Note that for some domains, which are known to be spoofed too often, this field says <skip> and other domain-related fields are empty.

• nameserver — name server, or several, for this domain

• Note the absence of "to" column - it would be my email there

Also note that hostname of this host is hidden from the logs in order to avoid spam.