Hello,
An abusive behaviour (Phishing) originating from your dedicated server ns3035079.ip-149-202-95.eu has been reported to or noticed by our Abuse Team.
Technical details showing the aforementioned problem follow :
— start of the technical details —
Hello,
Following our report regarding phishing email originating from the submission
server at IP address 149.202.95.232, please find attached the reported email,
headers included.
Regards,
Directorate General Technical Operations
The Romanian National Cyber Security Directorate
Hello,
Following our report regarding phishing email originating from the submission server at IP address 149.202.95.232, please find attached the reported email, headers included.
Regards,
Directorate General Technical Operations
———————————————-
The Romanian National Cyber Security Directorate
Delivered-To: corina.bros@gmail.com
Received: by 2002:a05:7108:5b85:b0:4e6:cf32:3e8f with SMTP id en5csp367053gdb;
Wed, 5 Nov 2025 07:03:39 -0800 (PST)
X-Google-Smtp-Source: AGHT+IE8Azhj88aBTfeDHEJvcH6h1QVMzdHQbEqDi8H1+5Gr2dtIfpkDOsOsCoc0O1siSxclmFFR
X-Received: by 2002:a05:6214:626:b0:880:38ba:a4d9 with SMTP id 6a1803df08f44-880711df737mr41911766d6.67.1762355019215;
Wed, 05 Nov 2025 07:03:39 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1762355019; cv=none;
d=google.com; s=arc-20240605;
b=ZmWSrZVZSKjWzmZOa0IUBj+hXtSDtTPhLlP5HyX9IdpPjZpSNvX1Qd8nnrQ92kevwW
YSlSIIdyApCwpLBMRgLnN+UJnUcTzUvRGo3CIruWPwiIbpDLefHRNQRKydvEAdsPNLA+
P4i8mubcYXyKd1BpMJp86iNuMs2PSkadqVDrHGMtMqFWEY/h0f58gGD01vRU411BNQdD
f7VCpL97YFLXoIqKz5PXOF3nU/XQ/EG803vgIadpFqkQacmBZ5dRcGtdO1YXpUXAh8Ck
6WcypGoy+sGjmudW+8VOe1VQnpSmSPYqYXs+xQiJ/WBUvgTrYt4sFBsSIKgvjxZrh7e6
XB2A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
h=to:from:subject:mime-version:date:message-id:sender:dkim-signature
:dkim-signature;
bh=3oR/2e1uS5ziEGr8eEUI7xKQ3RyL3R7ib7EfGAK7vcs=;
fh=kbVccavDVzFbkgyd1Ar6IrP5cqAYzfEK8O8pmdf8bUY=;
b=RM+eqxXMpCnSM1bGkc/a7cb9HuycJpA1AQDWFfcLtguT1VZJeQsExIqxokSuR8AB5W
2Uh0n+qXNY35fuptvp/Pt8mgMb8LknNGjauyHz6xLWeONjkRHZJJynyyEyh5Leriyrf3
JgOUis3ipFsDJBPhlmAvFwXF8neiNl5fGOHjPdzbfkr0kp58llrt+mghwoM68/Ca0TS6
Bz3vgjyI2RnxcDb9oRmLShn2oEtR3S2UKVpRMhpOIDtFbWlrSqUbA1T+lTrJLt7MSFVW
Eq1wK6692U14mcb851KoHfO0wCX30sK404veJlxLLu9pbrRkNwu027nh+HM0RinNUK8M
NZ0Q==;
dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@angebots2210.info header.s=smtp header.b=L316xTzZ;
dkim=pass header.i=@mailgun.org header.s=mg header.b=XIb5add7;
spf=pass (google.com: domain of bounce+dd940a.98612e-corina.bros=gmail.com@angebots2210.info designates 159.135.228.18 as permitted sender) smtp.mailfrom=»bounce+dd940a.98612e-corina.bros=gmail.com@angebots2210.info»
Return-Path:
Received: from m228-18.mailgun.net (m228-18.mailgun.net. [159.135.228.18])
by mx.google.com with UTF8SMTPS id 6a1803df08f44-8804ce320f5si35822366d6.105.2025.11.05.07.03.38
for corina.bros@gmail.com
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 05 Nov 2025 07:03:39 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce+dd940a.98612e-corina.bros=gmail.com@angebots2210.info designates 159.135.228.18 as permitted sender) client-ip=159.135.228.18;
Authentication-Results: mx.google.com;
dkim=pass header.i=@angebots2210.info header.s=smtp header.b=L316xTzZ;
dkim=pass header.i=@mailgun.org header.s=mg header.b=XIb5add7;
spf=pass (google.com: domain of bounce+dd940a.98612e-corina.bros=gmail.com@angebots2210.info designates 159.135.228.18 as permitted sender) smtp.mailfrom=»bounce+dd940a.98612e-corina.bros=gmail.com@angebots2210.info»
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=angebots2210.info; q=dns/txt; s=smtp; t=1762355018; x=1762362218;
h=To: To: From: From: Subject: Subject: MIME-Version: Content-Type: Date: Message-Id: Sender: Sender: X-Feedback-Id;
bh=3oR/2e1uS5ziEGr8eEUI7xKQ3RyL3R7ib7EfGAK7vcs=;
b=L316xTzZyowSIaMbKkqjlp8uP2gQ5V7el6qvTcSF87e1N/63TW5slxKudnY8HnzpoCYLrBwIOPI3mkTHW06rM/uSjNucB8I3XHTNEqJwKyc7zLpYh1DL/Vx+peCXmuEbYCNDKPxJjCsgr1VOLq3kRUN1CQWn3sixvDyYqWW0Kz4=
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mailgun.org; q=dns/txt; s=mg; t=1762355018; x=1762362218;
h=To: To: From: From: Subject: Subject: MIME-Version: Content-Type: Date: Message-Id: Sender: Sender: X-Feedback-Id;
bh=3oR/2e1uS5ziEGr8eEUI7xKQ3RyL3R7ib7EfGAK7vcs=;
b=XIb5add7dfVCgzg1AUonNJ9fgq03/7gxw2g3w9/LylShVqjAb7xd8nO/LcWdnYFxmfAk/LvWWlw/OxZef7FlFvQOQY32Gxy8FY9JPqLNvnr1+HDElRQwlg8LLvxMBoq8dSjD3dm9t+/TuL8xZu3MHjZkFEwvV5HEgyOCVGp24Q4=
X-Mailgun-Sid: WyIxODhhOCIsImNvcmluYS5icm9zQGdtYWlsLmNvbSIsIjk4NjEyZSJd
X-Feedback-Id: info@angebots2210.info::6908543552dfaf7aa486f1c8:mailgun
Received: from ns3035079.ip-149-202-95.eu (ns3035079.ip-149-202-95.eu [149.202.95.232])
by 378c87bdeda07fad5289ade19b1fa275bae442200cb0186dba02bbfa4f013858 with SMTP
id 690b674ae15f237726886985 (version=TLS1.3, cipher=TLS_AES_128_GCM_SHA256);
Wed, 05 Nov 2025 15:03:38 GMT
X-Mailgun-Sending-Ip: 159.135.228.18
Sender: info@angebots2210.info
Message-Id: 20251105150338.0c1b238c9533501f@angebots2210.info
Date: Wed, 05 Nov 2025 15:03:38 +0000
Content-Type: multipart/related;
boundary=»===============4117664940783575696==»
Subject: =?utf-8?q?Confirm=C4=83_v=C3=A2nzarea_pe_OLX_pentru_a_primi_plata_=C3=AEn_si?=
=?utf-8?q?guran=C8=9B=C4=83?=
From: =?utf-8?q?OLX_Informa=C8=9Bii?= info@angebots2210.info
To: corina.bros@gmail.com
MIME-Version: 1.0
—===============4117664940783575696==
Content-Type: multipart/alternative;
boundary=»===============7086753192507342070==»
—===============7086753192507342070==
Content-Type: text/html; charset=»utf-8″
Content-Transfer-Encoding: base64
PCFET0NUWVBFIGh0bWw+PGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGh0bWwi
IGxhbmc9InJvIj48aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVu
dD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4KICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29u
dGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgPG1ldGEgbmFt
ZT0ieC1hcHBsZS1kaXNhYmxlLW1lc3NhZ2UtcmVmb3JtYXR0aW5nIj4KICA8bWV0YSBodHRwLWVx
dWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPWVkZ2UiPgogIDxtZXRhIG5hbWU9ImZv
cm1hdC1kZXRlY3Rpb24iIGNvbnRlbnQ9InRlbGVwaG9uZT1ubyI+CiAgPHRpdGxlPjwvdGl0bGU+
CiAgPHN0eWxlIHR5cGU9InRleHQvY3NzIj4KICAgIGJvZHkgeyBtYXJnaW46MDsgcGFkZGluZzow
OyBiYWNrZ3JvdW5kLWNvbG9yOiNmNWY1ZjU7IGZvbnQtZmFtaWx5OkFyaWFsLCBIZWx2ZXRpY2Es
IHNhbnMtc2VyaWY7IGNvbG9yOiMzMzM7IH0KICAgIHRhYmxlIHsgYm9yZGVyLWNvbGxhcHNlOmNv
bGxhcHNlOyB9CiAgICBhIHsgY29sb3I6IzA3MDcyZTsgdGV4dC1kZWNvcmF0aW9uOm5vbmU7IH0K
ICAgIC5jbHNfdHppc3JnY2ggeyBtYXgtd2lkdGg6NjAwcHg7IHdpZHRoOjEwMCU7IG1hcmdpbjoy
MHB4IGF1dG87IGJhY2tncm91bmQtY29sb3I6I2ZmZjsgYm9yZGVyLXJhZGl1czo4cHg7IH0KICAg
IC5jbHNfZWllYnJhbHAgeyBiYWNrZ3JvdW5kLWNvbG9yOiMwNzA3MmU7IHBhZGRpbmc6MTVweDsg
dGV4dC1hbGlnbjpjZW50ZXI7IH0KICAgIC5jbHNfZWllYnJhbHAgaDEgeyBtYXJnaW46MDsgZm9u
dC1zaXplOjIycHg7IGNvbG9yOiNmZmY7IGZvbnQtd2VpZ2h0OmJvbGQ7IH0KICAgIC5jbHNfZmhr
b3B4aXYgeyBwYWRkaW5nOjIwcHg7IHRleHQtYWxpZ246Y2VudGVyOyBmb250LXNpemU6MTRweDsg
bGluZS1oZWlnaHQ6MS42OyB9CiAgICAuY2xzX3p2d3NzbnF3IHsgZGlzcGxheTppbmxpbmUtYmxv
Y2s7IHBhZGRpbmc6OHB4IDE1cHg7IGJhY2tncm91bmQ6I2VlZjBmNzsgY29sb3I6IzA3MDcyZTsg
Zm9udC13ZWlnaHQ6Ym9sZDsgYm9yZGVyLXJhZGl1czo0cHg7IG1hcmdpbjoxNXB4IDA7IGZvbnQt
c2l6ZToxNHB4OyB9CiAgICAuY2xzX21ta2l6Z3JuIHsgbWFyZ2luOjI1cHggMDsgfQogICAgLmNs
c19mcm5udmtncyB7IGRpc3BsYXk6aW5saW5lLWJsb2NrOyBwYWRkaW5nOjEycHggMzBweDsgYmFj
a2dyb3VuZC1jb2xvcjojMDcwNzJlOyBjb2xvcjojZmZmICFpbXBvcnRhbnQ7IGZvbnQtd2VpZ2h0
OmJvbGQ7IGJvcmRlci1yYWRpdXM6NHB4OyBmb250LXNpemU6MTVweDsgfQogICAgLmNsc19kcGRt
cXloaSB7IHBhZGRpbmc6MTVweDsgYmFja2dyb3VuZC1jb2xvcjojZjlmOWY5OyB0ZXh0LWFsaWdu
OmNlbnRlcjsgZm9udC1zaXplOjEycHg7IGNvbG9yOiM2NjY7IGxpbmUtaGVpZ2h0OjEuNTsgfQog
ICAgQG1lZGlhIG9ubHkgc2NyZWVuIGFuZCAobWF4LXdpZHRoOjYwMHB4KXsgLmNsc190emlzcmdj
aHttYXJnaW46MTBweDt3aWR0aDoxMDAlO30uY2xzX2Zybm52a2dze2Rpc3BsYXk6YmxvY2s7d2lk
dGg6MTAwJTttYXgtd2lkdGg6MjUwcHg7bWFyZ2luOjAgYXV0bzt9IH0KICA8L3N0eWxlPgo8L2hl
YWQ+Cjxib2R5PgogIDwhLS0gUHJlaGVhZGVyIC0tPgogIDxkaXYgc3R5bGU9ImRpc3BsYXk6bm9u
ZTttYXgtaGVpZ2h0OjA7b3ZlcmZsb3c6aGlkZGVuO29wYWNpdHk6MDsiPgogICAgQ29uZmlybcSD
IHbDom56YXJlYSBwZSBPTFggcGVudHJ1IGEgcHJpbWkgcGxhdGEgw65uIHNpZ3VyYW7Im8SDLgog
IDwvZGl2PgoKICA8dGFibGUgcm9sZT0icHJlc2VudGF0aW9uIiB3aWR0aD0iMTAwJSIgYmdjb2xv
cj0iI2Y1ZjVmNSI+CiAgICA8dGJvZHk+PHRyPgogICAgICA8dGQgYWxpZ249ImNlbnRlciIgc3R5
bGU9InBhZGRpbmc6MjBweCAxMHB4OyI+CiAgICAgICAgPHRhYmxlIHJvbGU9InByZXNlbnRhdGlv
biIgY2xhc3M9ImNsc190emlzcmdjaCI+CiAgICAgICAgICA8IS0tIEhlYWRlciAtLT4KICAgICAg
ICAgIDx0Ym9keT48dHI+CiAgICAgICAgICAgIDx0ZCBjbGFzcz0iY2xzX2VpZWJyYWxwIj48aDE+
T0xYIFJvbcOibmlhPC9oMT48L3RkPgogICAgICAgICAgPC90cj4KCiAgICAgICAgICA8IS0tIENv
bnRlbnQgLS0+CiAgICAgICAgICA8dHI+CiAgICAgICAgICAgIDx0ZCBjbGFzcz0iY2xzX2Zoa29w
eGl2Ij4KICAgICAgICAgICAgICA8cD5CdW7Egyw8L3A+CiAgICAgICAgICAgICAgPHA+UHJvZHVz
dWwgdMSDdSBsaXN0YXQgcGUgPHN0cm9uZz5PTFg8L3N0cm9uZz4gYSBmb3N0IGN1bXDEg3JhdC4g
IAogICAgICAgICAgICAgIFBlbnRydSBhIHByaW1pIHBsYXRhIMiZaSBhIGZpbmFsaXphIHRyYW56
YWPIm2lhLCB0ZSBydWfEg20gc8SDIGNvbmZpcm1pIHbDom56YXJlYS48L3A+CiAgICAgICAgICAg
ICAgPGRpdiBjbGFzcz0iY2xzX3p2d3NzbnF3Ij5OdW3Eg3IgY29tYW5kxIM6ICNCeFVyV09GPC9k
aXY+CgogICAgICAgICAgICAgIDx0YWJsZSByb2xlPSJwcmVzZW50YXRpb24iIGFsaWduPSJjZW50
ZXIiIGNsYXNzPSJjbHNfbW1raXpncm4iPgogICAgICAgICAgICAgICAgPHRib2R5Pjx0cj4KICAg
ICAgICAgICAgICAgICAgPHRkPjxhIGhyZWY9Imh0dHBzOi8vYXN0ZWFwdGFsaXZyYXJlLmNsaWNr
L3Jvc3YwNmttIiBjbGFzcz0iY2xzX2Zybm52a2dzIiB0YXJnZXQ9Il9ibGFuayI+Q29uZmlybcSD
IHbDom56YXJlYTwvYT48L3RkPgogICAgICAgICAgICAgICAgPC90cj4KICAgICAgICAgICAgICA8
L3Rib2R5PjwvdGFibGU+CgogICAgICAgICAgICAgIDxwIHN0eWxlPSJmb250LXNpemU6MTNweDtj
b2xvcjojNTU1OyI+UGVudHJ1IG9yaWNlIMOubnRyZWJhcmUsIG5lIHBvyJtpIHNjcmllIGxhICAK
ICAgICAgICAgICAgICA8YSBocmVmPSJtYWlsdG86c3Vwb3J0QG9seC5ybyI+c3Vwb3J0QG9seC5y
bzwvYT4uPC9wPgogICAgICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KCiAgICAgICAgICA8
IS0tIEZvb3RlciAtLT4KICAgICAgICAgIDx0cj4KICAgICAgICAgICAgPHRkIGNsYXNzPSJjbHNf
ZHBkbXF5aGkiPgogICAgICAgICAgICAgIEFjZXN0IGUtbWFpbCBhIGZvc3QgdHJpbWlzIGF1dG9t
YXQgw65uIGxlZ8SDdHVyxIMgY3UgbyB0cmFuemFjyJtpZSBPTFguPGJyPgogICAgICAgICAgICAg
IMKpIDIwMjUgT0xYIFJvbcOibmlhIHwgPGEgaHJlZj0iJmx0OyU9IHVuc3Vic2NyaWJlVXJsICUm
Z3Q7Ij5EZXphYm9uYXJlPC9hPgogICAgICAgICAgICA8L3RkPgogICAgICAgICAgPC90cj4KICAg
ICAgICA8L3Rib2R5PjwvdGFibGU+CiAgICAgIDwvdGQ+CiAgICA8L3RyPgogIDwvdGJvZHk+PC90
YWJsZT4KCiAgPCEtLSBQbGFpbi10ZXh0IGZhbGxiYWNrIC0tPgogIDxkaXYgc3R5bGU9ImRpc3Bs
YXk6bm9uZTsiPgpGcm9tOiBPTFggUm9tw6JuaWEgPG5vLXJlcGx5QG9seC5ybz4gIApTdWJqZWN0
OiBDb25maXJtxIMgdsOibnphcmVhIHBlIE9MWCBwZW50cnUgYSBwcmltaSBwbGF0YSAgCgpQcm9k
dXN1bCB0xIN1IGEgZm9zdCBjdW1wxINyYXQgcGUgT0xYLiBDb25maXJtxIMgdsOibnphcmVhIHBl
bnRydSBhIHByaW1pIHBsYXRhIMiZaSBhIGZpbmFsaXphIHRyYW56YWPIm2lhLiAgCgpOdW3Eg3Ig
Y29tYW5kxIM6ICNldEpiTVdBIApDb25maXJtxIMgdsOibnphcmVhOiBodHRwczovL2FzdGVhcHRh
bGl2cmFyZS5jbGljay9yb3N2MDZrbQoKU3Vwb3J0OiBzdXBvcnRAb2x4LnJvICAKRGV6YWJvbmFy
ZTogJmx0OyU9IHVuc3Vic2NyaWJlVXJsICUmZ3Q7ICAKICA8L25vLXJlcGx5QG9seC5ybz48L2Rp
dj4KCgo8L2JvZHk+PC9odG1sPg==
—===============7086753192507342070==—
—===============4117664940783575696==—
— end of the technical details —
Your should investigate and fix this problem, as it constitutes a violation to our terms of service.
Please answer to this e-mail indicating which measures you’ve taken to stop the abusive behaviour.
Cordially,
The OVHcloud Trust & Safety team.
