New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Who is hostingturkiye, I got account and marketing mail without consent
kenjing789
Member
in Help
Recently I keep get spam from them and it land on mainbox but I'm sure I don't know or never register on them before. Checking all Mailbox and Password Manager but there no clue where or when did I have account with them.
They use my non forward mail address(no postfix) but have correct (old) profile and billing data.
Since I don't have credential, reset password and try get in account show Last Login is last week(?) on the days I don't have access to internet with my current VPN IP.
Any LowEndDetective have clue ? I suspect they are repuc/awmsibilism rebranded or some data breach import but no clue, this is torturer me every night.
Comments
Calin started new basement DC in Turkey
Using the already stolen whmcs db
What i would do if not having an account
1. Report as spam
2. Create filter to delete the email automatically
To help LowendDetective, you should share the email headers.
Received: by 2002:a05:7208:901a:b0:a2:af90:3a2b with SMTP id j26csp1812466rbd;
Thu, 14 Aug 2025 07:44:34 -0700 (PDT)
X-Forwarded-Encrypted: i=2; AJvYcCWbIo5TShPqHcSSyGwKqVI9/GfplYlvE9TbVoqKmjiqNsUo6eUyYHXOY7VoQjucoBXBtxDTs4oYh59O@gmail.com
X-Google-Smtp-Source: AGHT+IFGP3KznrdZwaWn0FNhg7omimgM815H6atJXES+lj4E4yZkL/UTNYyrX11OGoohCyIogaW4
X-Received: by 2002:a05:6000:200e:b0:3b7:942c:5450 with SMTP id ffacd0b85a97d-3ba50c8cfc0mr2742020f8f.9.1755182674069;
Thu, 14 Aug 2025 07:44:34 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1755182674; cv=none;
d=google.com; s=arc-20240605;
b=KmWG1gJoRpCqP/ESOz659HjM4Gj8PO5ijbizd41u9YTnUUe/R+XaymXw3LPYKQrAYj
MAi0P6tOl7bxuw6UOXuQRGol0weKoeUAKNCS0RvLTNEFwcHOzPB9M4JpwSTcrGawteBD
uWERLA0mTLX+GNF6sEPtW2xQDUaSa7h2fMpXVJhKtyJ8hohTfNNe1fJG5QrFkKFpuvov
MwRD71f5F7vCTZZvyR+5SDIbyLvMvdHzmjolvks3RTnDXa5YUImMuQo9f/nAtpt+GvU5
bh7mRwObOchZ3jHWY8hJlO7i9taPvuCd8g7IpjHvlFzTBnOV7/5Xxc3acnk1vRNeIxCe
DsYw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
h=content-transfer-encoding:mime-version:message-id:subject:from:to
:date:dkim-signature;
bh=vpzYrVis8g0lVT5t4ZkqhCXU68j635jO8KvXpVmpZZw=;
fh=Pr2plYkJn0ovdHybgHvE53243CPsqSX0NRPDPDnAMwQ=;
b=InWz6Dzan5KS6Emccb1zoxXyR7ORkbPgW5U8iGTOrTn82W95A/C/3l18ua43YOKfOB
pwLE/tFSyzVmgGCwTdCpwdJuoVIt3+BITmTMObue3s08P3q9ja2SZnvw0n7nxH1MjeK7
QyXUXgYNGJPlnDD4dKcKOL/4vN6ouE6KohgexwcKUeZ6pGprhrYO9ygfBnEIeDsosZNl
SM9sfeOKkUPbMlzrgjVNryQ/vHeXYcqOmuwvKo0Do675KxyaXpxR9Lgyecpg63zTRxNS
fceRg4VQeGWUD1nCNWYtj3fVe8UZ1paBKhnEgNxtdto7jTKX0f1isMbT36Gr0M6Kc1Zz
+FaQ==;
dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@hostingturkiye.com.tr header.s=default header.b=gYl9JGHg;
spf=pass (google.com: domain of [email protected] designates 45.138.183.4 as permitted sender) [email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=hostingturkiye.com.tr
Return-Path: info@hostingturkiye.com.tr
Received: from cpanel01.hostingturkiye.com.tr (cpanel01.hostingturkiye.com.tr. [45.138.183.4])
by mx.google.com with ESMTPS id ffacd0b85a97d-3b79c6bc03bsi19729740f8f.622.2025.08.14.07.44.33
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 14 Aug 2025 07:44:34 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 45.138.183.4 as permitted sender) client-ip=45.138.183.4;
Authentication-Results: mx.google.com;
dkim=pass header.i=@hostingturkiye.com.tr header.s=default header.b=gYl9JGHg;
spf=pass (google.com: domain of [email protected] designates 45.138.183.4 as permitted sender) [email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=hostingturkiye.com.tr
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=hostingturkiye.com.tr; s=default; h=Content-Transfer-Encoding:Content-Type: MIME-Version:Message-ID:Subject:From:To:Date:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=vpzYrVis8g0lVT5t4ZkqhCXU68j635jO8KvXpVmpZZw=; b=gYl9JGHgFlcfXK+TrZx0BoW+IL utAuSMwwhypG0zTEzjljjcNmXpuFZEk2UWURm2Ows2xAazLc6CQlLh43Sf2R1rr4iMZq+feLCPY09 HovsbkiU3aJ9bhd34ATt6asvWAwPQVcNMoxLBxwGOd1cMjFRe8QevuaNLNB+A7cyEh1d6a6fhGjgW kxD1s+aATBo8N9SeaHPatXIGFADhl5Lz6UwRsB+bCBLIq3P/TsvkFwFo56G5xZtp+VzyRLxY9fg+s zuB7cohZG+ixboqVSc4hvbs9ByqgXgtLg8Gh0+gOuZtfesAExVWD/4n5QO3wSiwNM1AtdNMbxnuqz V/1ulq6Q==;
Received: from [45.138.183.4] (port=50344 helo=hostingturkiye.com.tr) by cpanel01.hostingturkiye.com.tr with esmtpsa
(TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98) (envelope-from info@hostingturkiye.com.tr) id 1umZ3k-0000000CFxc-0eID; Thu, 14 Aug 2025 17:36:08 +0300
Date: Thu, 14 Aug 2025 17:30:36 +0300
To: undisclosed-recipients:;
From: Hosting Turkiye Internet ve Bilisim Hizmetleri info@hostingturkiye.com.tr
Subject: Yeni Nesil Kurumsal Barındırma Çözümleri – Hosting Türkiye | Enterprise Hosting Solutions with NVMe and IPv6
Message-ID: pg6OzPJE8MS8kgjpmYC0mYSwCjkfNULYS8yxBpdkr0Q@hostingturkiye.com.tr
X-Mailer: PHPMailer 6.6.5 (https://github.com/PHPMailer/PHPMailer)
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - cpanel01.hostingturkiye.com.tr
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - hostingturkiye.com.tr
X-Get-Message-Sender-Via: cpanel01.hostingturkiye.com.tr: authenticated_id: [email protected]
X-Authenticated-Sender: cpanel01.hostingturkiye.com.tr: [email protected]
X-Source:
X-Source-Args:
X-Source-Dir:
Here you go
BATU CLOUD LTD - Muhammed Fatih ASAN
source: https://find-and-update.company-information.service.gov.uk/company/15676601/officers
https://lowendtalk.com/profile/batucloud
https://lowendtalk.com/profile/mfatihasan
.
Muhammed Fatih ASAN
AS Number 215761
Website https://hostingturkiye.com.tr/
source: https://bgp.tools/as/215761
.
batucloud.com (45.138.183.4)
hostingturkiye.com.tr (45.138.183.4)
If you check the two websites, the "two" companies has the same address and phone number.
I was suspect BatuCloud before too since that some of turky provider I registered. I didnt know they were banned on LET so was assume it not them.
Best Detective.