I am experiencing the same junk mail issue!!!
Every day I receive 20 to 30 spam emails from subdomains under gostarmedia.com. These are not ordinary spam messages — they bypass filters, abuse Exchange Online relays, and render Microsoft’s rules completely ineffective.
I’ve attempted every possible workaround:
- I created rules for “Body contains gostarmedia”
- I created rules for “Sender address contains gostarmedia.com”
Neither of these actions worked. Not one message was filtered or moved.
After investigating the message headers and sources with the help of ChatGPT I found the following:
| Category |
Pattern / Detail |
| Sender Display Names |
Random promotional names impersonating legitimate offers |
| From Domains |
All use *.gostarmedia.com subdomains with obfuscating ' character |
| Return-Path Domains |
Always randomized fake domains under .edu.info |
| SPF / DKIM / DMARC |
None present in any message |
| Primary Link Host |
20.218.142.124.static.hostiran.name in all embedded, unsubscribe, and image URLs |
| Tracking Pixels |
Same hostiran.name 1×1 image pixel tracker |
| Message Spam Score (SCL) |
9 in all cases — maximum severity spam |
| Delivery Method |
Relayed via Microsoft Exchange Online / Office365 EOP Frontend |
| HTML Email Type |
Yes — heavy use of HTML, inline styling, external links |
| Cloud VPS Sending IPs |
Disposable cloud IPs — different each time but pattern of VPS/cloud-hosted source |
This isn’t a one-off incident — it’s a systematic abuse operation exploiting gaps in Microsoft’s filtering and rule enforcement.
Microsoft needs to address this urgently.
- Inbox rules aren’t catching these patterns.
- The spam filter identifies these as SCL 9 yet still delivers them.
- The sender domains and infrastructure are known and repeatable — yet no permanent block exists.
As a long-time Hotmail/Outlook user, I expect Microsoft to seriously review this abuse vector and implement stricter control mechanisms against these kinds of campaigns.
Please escalate this to the security and filtering product teams. We are getting hammered by the same operation daily and left defenseless.
Thank you.
Microsoft Rules:




Here is one of the email's sources:
Received: from DU0P192MB2503.EURP192.PROD.OUTLOOK.COM (::1) by DB7P192MB0425.EURP192.PROD.OUTLOOK.COM with HTTPS; Sun, 29 Jun 2025 08:53:38 +0000 Received: from PH7PR17CA0031.namprd17.prod.outlook.com (2603:10b6:510:323::14) by DU0P192MB2503.EURP192.PROD.OUTLOOK.COM (2603:10a6:10:5a6::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8901.13; Sun, 29 Jun 2025 08:53:37 +0000 Received: from CY4PEPF0000EE3C.namprd03.prod.outlook.com (2603:10b6:510:323:cafe::a4) by PH7PR17CA0031.outlook.office365.com (2603:10b6:510:323::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8880.28 via Frontend Transport; Sun, 29 Jun 2025 08:53:36 +0000 Authentication-Results: spf=none (sender IP is 13.64.232.165) smtp.mailfrom=swglv.4n4n146xba.edu.info; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=; Received-SPF: None (protection.outlook.com: swglv.4n4n146xba.edu.info does not designate permitted sender hosts) Received: from autdjcch.znxviuwiudsaui.eu.com (13.64.232.165) by CY4PEPF0000EE3C.mail.protection.outlook.com (10.167.242.13) with Microsoft SMTP Server id 15.20.8901.15 via Frontend Transport; Sun, 29 Jun 2025 08:53:35 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:E5C76A06D69C8E438DAC49C794A704DE5C5CA8477FEF03DE014840D0A3A94CBE;UpperCasedChecksum:FFFD3C7BE9400DD3B1A3A2115E09B6570CC3D7E5C7F5389FA7362065EA679F2F;SizeAsReceived:309;Count:8 Date: Sat, 28 Jun 2025 03:05:38 +0000 To:
Say Goodbye to Switching Glasses for Good!
Tired of juggling multiple pairs of glasses to see clearly? Flex Focus Adjustable Glasses are here to simplify your life. With advanced adjustable lens technology, you can easily change your focus to suit any situationâreading, driving, or enjoying the view.
No prescriptions. No hassle. Just perfect clarity wherever you are. Designed for ultimate convenience and comfort, these glasses are lightweight, durable, and stylish enough to wear all day.
Get Your Flex Focus Glasses Today
If you wish to unsubscribe from future mailings please click here or write to:
221 W 9th St #188 Wilmington, DE 19801
This is an advertisement.
