# Report Abuse — Oveyon

> How to report abuse, spam or phishing originating from Oveyon's infrastructure. We process ARF/FBL, DMARC and TLS-RPT automatically and respond to mailbox providers and authorities.

Text version of https://oveyon.com/abuse.
Em português: https://oveyon.com.br/abuse
If you are an agent and need email, the procedure is at https://oveyon.com/llms.txt

Trust & safety

## Report abuse

Oveyon operates email sending infrastructure. If you received spam, phishing or any improper message originating from our network, this is the right channel to notify us. Mailbox providers, security researchers and authorities will find here how to reach us and how reports are handled.

Abuse contact · **abuse@oveyon.com**
Triage · **prioritized by severity**
Last updated · **August 26, 2026**

Immediate action

Reporting **phishing, malware or a compromise in progress**? Write to [abuse@oveyon.com](mailto:abuse@oveyon.com) with the subject starting with `[URGENT]` and attach the message with full headers. The `[URGENT]` prefix helps our triage prioritize the case.

### On this page

1. [How to report](https://oveyon.com/abuse#report)
2. [What to include](https://oveyon.com/abuse#what-to-include)
3. [Automated channels](https://oveyon.com/abuse#automated)
4. [How we handle it](https://oveyon.com/abuse#handling)
5. [Authenticated reports](https://oveyon.com/abuse#authenticated)
6. [Authorities and court orders](https://oveyon.com/abuse#legal)
7. [Vulnerability disclosure](https://oveyon.com/abuse#security)

### 01 How to report

Forward the offending message — **with full headers preserved** — to:

General abuse abuse@oveyon.com Spam, non-consented lists, improper content.

Security abuse@oveyon.com · [URGENT] Phishing, malware, fraud, compromised account.

Privacy privacy@oveyon.com Personal data, data-subject rights (GDPR/LGPD).

Legal legal@oveyon.com Court orders, requests from authorities.

Every message sent through our infrastructure carries an `X-Report-Abuse` header and a `Feedback-ID` — they let us correlate the report to the exact message and sender.

### 02 What to include

So we can act quickly and accurately, include as much as possible:

- The **complete message, with all headers** (not just the body or a screenshot);
- The affected recipient's address;
- Date, time and timezone of receipt;
- The `Feedback-ID`, the `Message-ID` or the return-path (`bounce+…@bounce.oveyon.com`), if available;
- A brief description of the problem (spam, phishing, malware, missing unsubscribe, etc.).

### 03 Automated channels

For mailbox providers and network operators, we maintain the industry-standard channels — processed automatically:

| Channel | Standard | What we do |
| --- | --- | --- |
| Feedback Loop (FBL) / complaint | ARF · RFC 5965 | We parse the report and correlate the complaint to the sender; automatic suppression and scoring. |
| Aggregate DMARC (RUA) | RFC 7489 | We ingest and parse the reports; classify legitimate IPs vs. spoofing. |
| TLS-RPT | RFC 8460 | We ingest the TLS transport-failure reports on delivery. |
| Bounce / DSN | VERP | We correlate the DSN to the exact message via the return-path and act on suppression. |

If you operate an FBL and want to include us, write to [abuse@oveyon.com](mailto:abuse@oveyon.com).

### 04 How we handle a report

Every valid report becomes an abuse event correlated to the sender, domain and IP. From there, proportionally:

1. **We confirm and correlate** — we identify the message, the sender and the pattern;
2. **We aggregate** — an isolated complaint is different from a rate that crosses the risk threshold;
3. **We contain the damage** — throttle, freeze (sandbox), recipient suppression, sender suspension or account termination, depending on severity;
4. **We record** everything in an audit trail;
5. **We get back** to the reporter, where a reply address is available, as soon as reasonably possible.

The sanctions applicable to the sender are described in the [Acceptable Use Policy](https://oveyon.com/aup#enforcement).

### 05 Authenticated reports

Anti-forgery

A complaint is only treated as **trusted** when it passes DKIM and comes from a recognized FBL provider. This closes the "forged self-suspension" vector, where a third party would try to take down a legitimate sender by sending fake complaints in their name. Human reports by email are always reviewed, but do not trigger automatic actions on their own.

### 06 Authorities and court orders

Requests from authorities, court orders and data-preservation requests should be sent to [legal@oveyon.com](mailto:legal@oveyon.com). We respond to legally valid requests in accordance with applicable law and our [Privacy Policy](https://oveyon.com/privacy). We do not log message content (the body); we retain sending metadata and the archived object according to the retention policies described in the Privacy Policy.

### 07 Vulnerability disclosure

Found a security flaw in the platform? Disclose it responsibly to [abuse@oveyon.com](mailto:abuse@oveyon.com) with the subject `[SECURITY]`. We ask that you not exploit the flaw beyond what is necessary to demonstrate it, that you not access third-party data, and that you give us reasonable time to fix it before any public disclosure.

This page describes how our abuse channel works for informational purposes. Handling actions are discretionary and proportionate to each case; nothing here creates a warranty, binding response time or contractual obligation beyond what is set out in the [Terms of Service](https://oveyon.com/terms) and the [AUP](https://oveyon.com/aup).

Contact

Abuse: [abuse@oveyon.com](mailto:abuse@oveyon.com) · Privacy: [privacy@oveyon.com](mailto:privacy@oveyon.com) · Legal: [legal@oveyon.com](mailto:legal@oveyon.com)

Oveyon is a service of Akamind Inc., a Delaware C-corporation.

---

First email today. No card. — https://app.oveyon.com/app