Suspeits

Error Message

I am analyzing two transactional emails sent by the InfinityFree ecosystem related to account suspension due to inactivity.

Both emails pass SPF, DKIM, and DMARC authentication; however, they show different delivery outcomes in Gmail.

Email A (Inbox)

Subject: if0_*****.infinityfree… (Website for *****.rf.gd) is suspended for inactivity!

Sent via Amazon SES (eu-west-1) Domain: infinityfree… IP: 54.240.3.19 Delivered to Inbox

Email B (Spam)

Subject: InfinityFree.com account: q*****.infinityfree.com Inactive

Sent via ByetCluster infrastructure (byetcluster…) Sender domain: hostmessage.info IP: 82.163.176.4 DMARC policy: quarantine Delivered to Spam folder Includes internal system identifiers (account manager ID / account ID) Contains a reactivation link (HTTP with query parameters)

Technical observations:

Both messages pass SPF, DKIM, and DMARC authentication Email A uses Amazon SES with consistent domain alignment (infinityfree.com) Email B uses a ByetCluster relay with intermediate domain (hostmessage.info) Clear difference in sending infrastructure reputation (SES vs shared SMTP cluster)