In my site nobody@mycraftmail.com email coming suspiciously.
Don't know how above email gets coming. But, when I cross-checked those request. Those are from Amazon AWS IP(54.71.187.124). On googled further, found that email is in phishing database.
https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-links-ACTIVE.txt
Did anyone have an idea about it?