Mailbox providers (Gmail, Yahoo, Microsoft, Comcast, etc.) send ARF reports (RFC 5965) when their users mark a message as spam or phishing, or when DKIM/SPF authentication fails. Each report is a multipart message with the original message embedded and a structured key=value section listing the receiver's evidence. Paste the raw report and we parse it.
abuse — a recipient marked the message as spam/phishing. The most common reason mailbox providers send ARF reports.auth-failure — the receiver's DMARC/SPF/DKIM check failed. Often paired with ruf= in your DMARC record.virus / fraud / other — less common, used by anti-malware vendors and a few proprietary feeds.