How to Spot and Avoid Fake Bombas
Don’t get fooled this holiday season.
Bombas <[email protected]>
Share
Bombas promotes authenticity and warns against counterfeit products, especially during the holiday season. They advise customers to verify the URL and look for their official TikTok Shop store with a blue verification checkmark. Bombas encourages customers to shop directly on their site or in authorized retail stores to ensure authenticity and support their donation program.
What the raw message shows
From the headers
- Sent with
-
Braze
In the HTML
- Built with
- Dark-mode styles
Across Bombas's email
- Sends
- About 5 a week
- DMARC
-
Enforced, reject
Mail failing authentication is refused.
The copy
266 words · about 1 min to read · 3 buttons
Sign up for texts to stay up to date on holiday drops and sales. Sign Up →
Button Women
Button Men
Button Kids
Hey,
As you know, we make some pretty comfy socks, slippers, underwear, and tees. Unfortunately, Bombas are so great, some people attempt to impersonate us around the holidays to sell counterfeit, unauthorized, and way less comfy products.
To make sure you’re getting the real deal, and making a real impact with every Bombas purchase, we recommend looking out for a few things:
If you see an ad promoting steep discounts on social media, SMS, or any ad platform, make sure the URL in the ad brings you to www.bombas.com or one of our authorized retail partners. If it doesn’t, it’s probably an imposter.
We now have an official Bombas TikTok Shop store! You can identify it by looking for a blue verification checkmark next to our name, and our official handle: @bombas.
Any TikTok Shop page that isn’t our official store is unauthorized, which means they may be counterfeit products, and—unlike real Bombas purchases—it will not spark a donation for those experiencing homelessness.
If you’re not 100% sure, you can always shop directly on our site at or in one of our Bombas retail stores.
Think you spotted a site or shop impersonating Bombas or even purchased from one? Reply directly to this email, so we can take all necessary steps to help prevent these fraudsters in the future.
Stay safe and cozy out there,
Bombas
ONE PURCHASED ONE DONATED
100% HAPPINESS GUARANTEED
Get Texted Exclusive Offers
Bombas 881 Broadway, 2nd Floor New York, NY 10003
The words as text: what a screen reader can follow, and all there is when images don't load.
What the headers say
Read from the message's own headers, as it arrived.
- Came from
-
fsh2odb9.hello.bombas.com
· 137.22.228.136
Braze's sending servers
- SPF
- Pass for hello.bombas.com
- DKIM
-
- Pass signed by hello.bombas.com
- DMARC
-
Pass for hello.bombas.com
Policy: reject
- Unsubscribe
-
One-click
Meets the Gmail and Yahoo rule for bulk senders.
- Complaints
- No feedback-loop header
Show all 14 headers Hide the headers
As received, minus the delivery side: the archive's own addresses show as [recipient], its mail servers as [receiver], signatures are left out and unsubscribe links trimmed to their host.
Route
- Received
- from fsh2odb9.hello.bombas.com (137.22.228.136) by [receiver] (cloudflare) id UpmzABcKsLxX for <[recipient]>; Fri, 06 Nov 2026 19:12:38 +0000
- Received
- from [10.90.4.214] ([10.90.4.214]) by i-06c32d0965883dcfb.mta1vrest.sd.prd.sparkpost (ecelerity 5.3.0.76596 r(msys-ecelerity:tags/5.3.0.35)) with REST id 87/2B-37303-E962EEA6; Fri, 06 Nov 2026 19:12:30 +0000
Authentication
- Received-SPF Authentication result
- pass ([receiver]: domain of [email protected] designates 137.22.228.136 as permitted sender) receiver=[receiver]; client-ip=137.22.228.136; envelope-from="[email protected]"; helo=fsh2odb9.hello.bombas.com;
- Authentication-Results Authentication result
- [receiver]; dkim=pass [email protected] header.s=scph0623 header.b=vamt+y3O; dmarc=pass header.from=hello.bombas.com policy.dmarc=reject; spf=none ([receiver]: no SPF records found for [email protected]) smtp.helo=fsh2odb9.hello.bombas.com; spf=pass ([receiver]: domain of [email protected] designates 137.22.228.136 as permitted sender) smtp.mailfrom=msprvs1=207704H_T6ozi=bounces-266693-916@hello.bombas.com; arc=none smtp.remote-ip=137.22.228.136
Platform
- X-MSFBL
- XkmjZaV/jyD54l6FmSvtyf/3rVMXqZp2fTOj6HT87pA=|eyJtZXNzYWdlX2lkIjo iNmFlZDllMjZlZTZhNjM0NTMyNzgiLCJ0ZW5hbnRfaWQiOiJzcGMiLCJyIjoiYm9 tYmFzQGluYm94YXJjaGl2ZS5vcmciLCJjdXN0b21lcl9pZCI6IjI2NjY5MyIsInN 1YmFjY291bnRfaWQiOiI5MTYifQ==
Unsubscribe and feedback
- List-Unsubscribe
- <https://05.emailinboundprocessing.com/…>,<mailto:…@unsubscribe-05.emailinboundprocessing.com>
- List-Unsubscribe-Post
- List-Unsubscribe=One-Click
Message
- From
- "Bombas" <[email protected]>
- Message-ID
- <87.2B.37303.E962EEA6@i-06c32d0965883dcfb.mta1vrest.sd.prd.sparkpost>
- Date
- Fri, 06 Nov 2026 19:12:30 +0000
- Content-Type
- multipart/alternative; boundary="_----UE7Qc/q+YDVgOXim0ezFcg===_45/2B-37303-E962EEA6"
- MIME-Version
- 1.0
- Subject
- How to Spot and Avoid Fake Bombas
- Reply-To
- [email protected]
More from Bombas
All 57 emailsSimilar campaigns from other brands
Different brands running the same play. Compare any of them side by side.
Archived for reference and commentary. Bombas, its logos and content are the property of their respective owners; Inbox Archive claims no affiliation and has disabled all links. If you own this content and would like it removed, get in touch.