Field dossier · 21 October 2026
Inside 1,868 recovered junk messages.
A deleted Junk folder looked like lost evidence. Recovery exposed two months of repeated cloud-storage, subscription, health, delivery and security lures—and the infrastructure those messages kept reusing.
What the recovery established
Microsoft Outlook restored 1,947 items from its recoverable-items layer. A read-only inventory then recorded 1,868 messages present in Junk, spanning 20 August through 21 October 2026. The two numbers describe separate recovery and inventory stages; they are not presented as one reconciled count.
items restored from recoverable storage
messages in the captured Junk inventory
owned mailboxes verified after new controls
owned domains covered by impersonation rules
The campaigns were brands on the surface and domains underneath
The most repeated visible stories changed constantly: a locked cloud account, a failed McAfee payment, a Paramount renewal, a blood-pressure cure, Miracle Sheets, a blocked account and a complimentary MyChart kit. The underlying action domains repeated more reliably than the display names.
Cloud ID locked
The message threatened deletion of photos and videos. Its action link used a subdomain of bringyournewproduct.org.
Blood-pressure cure
The lure invoked Dr. Oz and linked through ni03hfph.com plus another bringyournewproduct.org subdomain.
McAfee payment failure
The message used an action host under offerestore.online while loading decorative assets from unrelated public services.
Paramount renewal
The threat of immediate account removal led through a subdomain of speakupthisisgreatt.org.
Miracle Sheets
The action host was 051jcugcxpo.fasteshop.site, then resolving to 64.31.39.240.
Blocked cloud account
The action host was tgftxgmegqkmz.nesvermedia.com, then resolving to 64.31.4.252.
The infrastructure we could name
Action domain
fasteshop.site
Observed in 22 identical “Miracle Sheets” messages. Public RDAP identified Namecheap as registrar. The active host resolved to 64.31.39.240 in a Limestone Networks allocation on 21 October 2026.
Action domain
nesvermedia.com
Observed in 12 “blocked account” messages. Public RDAP identified Namecheap as registrar. The active host resolved to 64.31.4.252 in a Limestone Networks allocation on 21 October 2026.
Repeated campaign domains
bringyournewproduct.org, ni03hfph.com and speakupthisisgreatt.org
These names recurred across different stories. At the time of review, some related domains no longer resolved or were held. Historical presence in a message remains evidence of the campaign, while current DNS state remains a separate observation.
Commercial names disclosed by a funnel
Live Free Fitness App and Easy Promo Finds
The separate MyChart investigation found these public-facing names in the recurring-subscription funnel. No independently verified legal operator or natural person was disclosed by the material.
What “behind it” means in evidence
Namecheap and Limestone Networks are named here because public records tied them to registrar and network roles. That does not make either company the sender or operator of the campaign. Two domains sharing a registrar and hosting network support a provider-correlation request; they do not prove that the same customer account or person controlled both. Only the providers' private account, billing, authentication and access records can answer that question.
Likewise, a sender label such as a first name, a copied business name or a Gmail profile is not reliable personal attribution. It may be fabricated, automated or taken from a compromised account. Meilo exposes the technical chain and names a person only when independent records connect that person to control of the abusive service.
Reports sent from this evidence
- 01
Recover before deleting
The Outlook recoverable-items layer was used to restore the evidence. The later inventory was read-only; no second bulk deletion followed.
- 02
Group by repeated facts
Subjects, sender patterns and action hosts separated recurring campaigns from one-off mail. Decorative image hosts were not accused merely because a message loaded an image from them.
- 03
Send role-specific packets
Transport-verified reports were sent to Namecheap for the two active registered domains and to Limestone Networks for the two active IP addresses. Each packet asked the recipient to preserve account and access records, correlate control and act if its investigation confirmed abuse.
- 04
Keep claims within the receipts
The evidence proves the reports were sent and an owner copy was preserved. It does not yet prove that either provider accepted the allegation, identified a customer or disabled service.
The investigation also changed the defended environment
The response did not stop at complaints. A new mail rule now catches messages claiming any of 43 owned domains when receiver authentication records DMARC failure, or records no DMARC result together with a failed or invalid SPF result. The rule preserves a private review copy before filing the source message into Junk.
All 58 owned mailboxes were read back and verified against the deployed rule. The domain audit found DMARC at p=reject on 40 account domains and live configured DKIM selectors on all 41 enabled XXV domains. One remaining domain was moved from quarantine to reject with its exact previous record saved for rollback.
What this exposes—and what it still cannot prove
Directly supported
Message counts, delivery times, action hosts, DNS answers, public registration and network roles, reports sent, authentication policy and verified control deployment.
Requires provider records
Subscriber identity, payment instrument, login history, related accounts and whether two hosted domains shared one customer.
Not established
A natural person's identity, physical location, motive or legal responsibility merely from a display name, writing style, shared IP or copied template.
Outcome language
“Sent” means a transport receipt exists. “Disabled” is used only after the object becomes unavailable and the provider confirms the reason.
Learn how to make the same distinction in your own case.
Read the attribution guideBuild a reporting workflow