Received: ME
Received: from mailcr.atnubis.com ([186.15.231.73])
by HOST
(envelope-from <soport ...
show moreReceived: ME
Received: from mailcr.atnubis.com ([186.15.231.73])
by HOST
(envelope-from <[email protected]>)
id 1pwawy-00EnK7-6R
Received: from mailcr.atnubis.com (localhost [127.0.0.1])
by mailcr.atnubis.com (Postfix) with ESMTPS id 4B79F472F57D;
Tue, 9 May 2023 16:57:10 -0600 (CST)
Received: from localhost (localhost [127.0.0.1])
by mailcr.atnubis.com (Postfix) with ESMTP id 10DEB446B8D0;
Tue, 9 May 2023 12:27:27 -0600 (CST)
X-Virus-Scanned: amavisd-new at mailcr.atnubis.com
Received: from mailcr.atnubis.com ([127.0.0.1])
by localhost (mailcr.atnubis.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id KZwdAmhUqR-j; Tue, 9 May 2023 12:27:26 -0600 (CST)
Received: from [100.64.100.6] (unknown [181.214.206.246])
by mailcr.atnubis.com (Postfix) with ESMTPSA id C49ED45EFD64;
Tue, 9 May 2023 10:50:41 -0600 (CST)
Received-SPF: OK
To: Recipients <[email protected]>
From: "Mike Weirsky" <[email protected]>
Reply-To: [email protected]show less
Received: from smtpcmd14173.aruba.it ([62.149.156.173])
by <my-mail-host> with esmtps (TLSv1.2:AES ...
show moreReceived: from smtpcmd14173.aruba.it ([62.149.156.173])
by <my-mail-host> with esmtps (TLSv1.2:AES128-GCM-SHA256:128)
To: <me>
From: T Mobile Zakelijk <[email protected]>
Subject: Je hebt onbetaalde facturen
Received-SPF: softfail (<my-mail-host>: transitioning domain of foker.com does not designate 62.149.156.173 as permitted sender) client-ip=62.149.156.173; [email protected]; helo=smtpcmd14173.aruba.it;
X-SPF-Result: <my-mail-host>: transitioning domain of foker.com does not designate 62.149.156.173 as permitted sender
Message-ID: <7WGPLognJ9ZmzhBoYXS7RFzHqON6lXSw4OaQNW1Hk@ubuntu-22-04-x64>
X-Mailer: PHPMailer 6.8.0 (https://github.com/PHPMailer/PHPMailer)
Authentication-Results: <my-mail-host>; spf=softfail [email protected]; dkim=pass header.i=aruba.it
X-SpamExperts-Class: unsure
show less
Delivered-To: Me
Received: from Mailhosting
by Mailserver (Postfix) with ESMTPS id D3155600A48
...
show moreDelivered-To: Me
Received: from Mailhosting
by Mailserver (Postfix) with ESMTPS id D3155600A48
for <Me>; Fri, 7 Apr 2023 01:49:28 +0200 (CEST)
Received: from mailrelay4-2.pub.mailoutpod2-cph3.one.com ([2a02:2350:5:409::1])
by Mailhosting with esmtps
(envelope-from <[email protected]>)
id 1pkZM4-009N5F-LL
for Me; Thu, 06 Apr 2023 23:49:28 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=avena-online.nl; s=rsa2;
h=<>;
bh=ZA1xqNieQ+pOVh3aqLrDA4HEihEoRmWdcr0DQdk6F3c=;
b=<>
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
d=avena-online.nl; s=ed2;
h=<>;
bh<>;
b=<>
X-HalOne-ID: a7872c97-d4d5-11ed-9c1c-592bb1efe9dc
Received: from 80.78.24.243 (504e18f3.host.njalla.net [2a0a:3840:8078:24:0:504e:18f3:1337])
by mailrelay4 (Halon) with ESMTPA
id a7872c97-d4d5-11ed-9c1c-592bb1efe9dc;
Thu, 06 Apr 2023 23:49:23 +0000 (UTC)
Date: Thu, 6 Apr 2023 23:49:22 +0000
To: Me
From: Bitvavo <[email protected]>
show less
Delivered-To: Me
Received: from Mailhosting
by Mailserver (Postfix) with ESMTPS id D3155600A48
...
show moreDelivered-To: Me
Received: from Mailhosting
by Mailserver (Postfix) with ESMTPS id D3155600A48
for <Me>; Fri, 7 Apr 2023 01:49:28 +0200 (CEST)
Received: from mailrelay4-2.pub.mailoutpod2-cph3.one.com ([2a02:2350:5:409::1])
by Mailhosting with esmtps
(envelope-from <[email protected]>)
id 1pkZM4-009N5F-LL
for Me; Thu, 06 Apr 2023 23:49:28 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=avena-online.nl; s=rsa2;
h=<>;
bh=ZA1xqNieQ+pOVh3aqLrDA4HEihEoRmWdcr0DQdk6F3c=;
b=<>
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
d=avena-online.nl; s=ed2;
h=<>;
bh<>;
b=<>
X-HalOne-ID: a7872c97-d4d5-11ed-9c1c-592bb1efe9dc
Received: from 80.78.24.243 (504e18f3.host.njalla.net [2a0a:3840:8078:24:0:504e:18f3:1337])
by mailrelay4 (Halon) with ESMTPA
id a7872c97-d4d5-11ed-9c1c-592bb1efe9dc;
Thu, 06 Apr 2023 23:49:23 +0000 (UTC)
Date: Thu, 6 Apr 2023 23:49:22 +0000
To: Me
From: Bitvavo <[email protected]>
show less
Sending extortion mail, probably through hacked account
Received: from unknown (HELO ?127.0.0.1?) ...
show moreSending extortion mail, probably through hacked account
Received: from unknown (HELO ?127.0.0.1?) ([email protected]@168.194.154.137)
by mailserver with ESMTPS (DHE-RSA-AES256-SHA encrypted); 17 Jul 2022 18:05:19 -0000
show less
messing around sending these kind of requests:
GET ///bin///wcm///search///gql.servlet.json?query ...
show moremessing around sending these kind of requests:
GET ///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix=
GET /admin/logs/errors.log
POST /users/login
GET /CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
GET /fosagent/repl/download-snapshot?name=..\\..\\..\\..\\..\\..\\..\\Windows\\win.ini
show less
Return-Path: <[email protected]>
Delivered-To: <Appsolutions>
Received: from iron ...
show moreReturn-Path: <[email protected]>
Delivered-To: <Appsolutions>
Received: from ironport.teleklik.net ([185.65.123.228])
by <Appsolutions>
(envelope-from <[email protected]>)
id 1nVwbL-0004wM-Tc
for <Appsolutions>; Sun, 20 Mar 2022 14:32:13 +0000
Received: from mail.euroexpress.ba ([185.65.122.178])
by smtp.teleklik.net with ESMTP; 20 Mar 2022 15:16:08 +0100
From: Bill Lawrence <[email protected]>
Reply-To: Bill Lawrence <[email protected]>
Message-ID: <[email protected]>
Subject: Bijdrage
Thread-Topic: Bijdrage
Received-SPF: pass (<Appsolutions>: domain of euroexpress.ba designates 185.65.123.228 as permitted sender) client-ip=185.65.123.228; [email protected]; helo=ironport.teleklik.net;
X-Mailer: Zimbra 8.8.15_GA_4173 (zclient/8.8.15_GA_4173)
X-Originating-IP: [88.233.173.250]
English: You have a received a donation of 5,500,000.00 Euro.
show less
show less
Return-Path: <[email protected]>
Delivered-To: <Appsolutions>
Received: from iron ...
show moreReturn-Path: <[email protected]>
Delivered-To: <Appsolutions>
Received: from ironport.teleklik.net ([185.65.123.228])
by <Appsolutions>
(envelope-from <[email protected]>)
id 1nVwbL-0004wM-Tc
for <Appsolutions>; Sun, 20 Mar 2022 14:32:13 +0000
Received: from mail.euroexpress.ba ([185.65.122.178])
by smtp.teleklik.net with ESMTP; 20 Mar 2022 15:16:08 +0100
From: Bill Lawrence <[email protected]>
Reply-To: Bill Lawrence <[email protected]>
Message-ID: <[email protected]>
Subject: Bijdrage
Thread-Topic: Bijdrage
Received-SPF: pass (<Appsolutions>: domain of euroexpress.ba designates 185.65.123.228 as permitted sender) client-ip=185.65.123.228; [email protected]; helo=ironport.teleklik.net;
X-Mailer: Zimbra 8.8.15_GA_4173 (zclient/8.8.15_GA_4173)
X-Originating-IP: [88.233.173.250]
English: You have a received a donation of 5,500,000.00 Euro.
show less
Return-Path: <[email protected]>
Delivered-To: <Appsolutions>
Received: from iron ...
show moreReturn-Path: <[email protected]>
Delivered-To: <Appsolutions>
Received: from ironport.teleklik.net ([185.65.123.228])
by <Appsolutions>
(envelope-from <[email protected]>)
id 1nVwbL-0004wM-Tc
for <Appsolutions>; Sun, 20 Mar 2022 14:32:13 +0000
Received: from mail.euroexpress.ba ([185.65.122.178])
by smtp.teleklik.net with ESMTP; 20 Mar 2022 15:16:08 +0100
From: Bill Lawrence <[email protected]>
Reply-To: Bill Lawrence <[email protected]>
Message-ID: <[email protected]>
Subject: Bijdrage
Thread-Topic: Bijdrage
Received-SPF: pass (<Appsolutions>: domain of euroexpress.ba designates 185.65.123.228 as permitted sender) client-ip=185.65.123.228; [email protected]; helo=ironport.teleklik.net;
X-Mailer: Zimbra 8.8.15_GA_4173 (zclient/8.8.15_GA_4173)
X-Originating-IP: [88.233.173.250]
English: You have a received a donation of 5,500,000.00 Euro.
show less
Envelope-to: <>
Received: from so254-27.mailgun.net ([198.61.254.27])
by <> with esmtps
(envel ...
show moreEnvelope-to: <>
Received: from so254-27.mailgun.net ([198.61.254.27])
by <> with esmtps
(envelope-from <bounce+f59d48.5e4891-info=<>@wawha.com>)
id 1nVPNZ-0026mY-3s
for <>;
Sat, 19 Mar 2022 05:03:45 +0100
DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=wawha.com; q=dns/txt; s=pic;
t=1647662625; h=Content-Type: MIME-Version: Message-ID: Date: Subject:
Subject: To: To: From: From: Reply-To: Sender: Sender;
bh=5MitE0ugl4R8scSYXYbaK4GhDQWX9d+ozgGggM86zH0=; b=gUIGorsYsU4MS1UwjwxtjdQgTQxlvvoVe+YaZ1GNGX0i6AmejLl8vvOL05P46O4yqunBEOBC
vt/HxfzwbHFAa6FUUz0QKLoOre0YzD6VRyn+8W3aaPfjxdmUuxGRm32eVSxDHoimJQQDNgn0
NcL3FtjKtDW2gIhSymODdbqkyNs=
X-Mailgun-Sending-Ip: 198.61.254.27
X-Mailgun-Sid: WyI0ODgwNyIsICJpbmZvQGxpc2Euc2tpIiwgIjVlNDg5MSJd
Sender: [email protected]
Received: from mailgun.net (Unknown [5.230.95.230])
by mxa.mailgun.org with ESMTP id 6235561f.7f4c89d352d0-smtp-in-n02;
Subject: Password reset for <Appsolutions>
show less
Envelope-to: <Appsolutions>
Received: from so254-27.mailgun.net ([198.61.254.27])
by <Appsolution ...
show moreEnvelope-to: <Appsolutions>
Received: from so254-27.mailgun.net ([198.61.254.27])
by <Appsolutions> with esmtps
(envelope-from <[email protected]>)
id 1nVPNZ-0026mY-3s
for <Appsolutions>;
Sat, 19 Mar 2022 05:03:45 +0100
X-Mailgun-Sending-Ip: 198.61.254.27
X-Mailgun-Sid: WyI0ODgwNyIsICJpbmZvQGxpc2Euc2tpIiwgIjVlNDg5MSJd
Sender: [email protected]
Received: from mailgun.net (Unknown [5.230.95.230])
by mxa.mailgun.org with ESMTP id 6235561f.7f4c89d352d0-smtp-in-n02;
From: Mailgun Support<[email protected]>
To: <Appsolutions>
Subject: Password reset for <Appsolutions>.
Date: 19 Mar 2022 05:03:41 +0100
Message-ID: <[email protected]>
[
Email contains a link to: https://sahzat.com.tr
Sat Mar 19 12:52:24 CET 2022
dig +short sahzat.com.tr A
45.151.249.143
]
show less
X-Spam-Level: ***
X-Spam-Status: No, score=3.8 required=5.0 tests=FROM_SUSPICIOUS_NTLD,
FROM_SUSP ...
show moreX-Spam-Level: ***
X-Spam-Status: No, score=3.8 required=5.0 tests=FROM_SUSPICIOUS_NTLD,
FROM_SUSPICIOUS_NTLD_FP,HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,
HTTPS_HTTP_MISMATCH,MIME_HTML_ONLY,RCVD_IN_MSPIKE_H2,
RCVD_IN_VALIDITY_RPBL,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,
URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.6
Received: from rextillerson.online ([199.127.61.97])
by <Appsolutions> with esmtp (Exim)
(envelope-from <[email protected]>)
id 1nVD5z-001tf1-MS
for <Appsolutions>;
Fri, 18 Mar 2022 15:56:49 +0100
MIME-Version: 1.0
From: Mailgun Invoicing <[email protected]>
To: <Appsolutions>
Subject: You have a new Mailgun by Pathwire invoice
Date: Fri, 18 Mar 2022 15:56:43 +0100
Message-Id: <[email protected]>
Content-Type: text/html
linkto:
https://54h62bn26db2bves.dvv-photoart.nl/
dig 54h62bn26db2bves.dvv-photoart.nl A @8.8.4.4
54h62bn26db2bves.dvv-photoart.nl. 118 IN A 199.127.61.97
show less
Received: from mail.cftech.ru ([212.248.72.88]) by MX with esmtps (TLSv1.3:TLS_AES_256_GCM_SHA384:25 ...
show moreReceived: from mail.cftech.ru ([212.248.72.88]) by MX with esmtps (TLSv1.3:TLS_AES_256_GCM_SHA384:256)
From: Bill Lawrence <[email protected]>
Reply-To: Bill Lawrence <[email protected]>
X-Mailer: Zimbra 9.0.0_GA_4204 (ZimbraWebClient - FF97 (Win)/9.0.0_GA_4204)
Thread-Index: B7yL9raiY9JVi2Dr6ct/LmBLdsOQvw==
Received-SPF: pass (MX: domain of cftech.ru designates 212.248.72.88 as permitted sender) client-ip=212.248.72.88; [email protected]; helo=mail.cftech.ru;
X-SPF-Result: MX: domain of cftech.ru designates 212.248.72.88 as permitted sender
Authentication-Results: MX;
iprev=pass (mail.cftech.ru) smtp.remote-ip=212.248.72.88;
spf=pass smtp.mailfrom=cftech.ru;
dkim=pass header.d=cftech.ru header.s=F5E6D0F6-47FF-11EA-8C08-53BE454EED0F header.a=rsa-sha256;
dmarc=pass header.from=cftech.ru
Authentication-Results: MX; spf=pass [email protected]; dkim=pass header.i=cftech.ru
Mail: got a donation of 3500000 eur from Bill, only need to contact him..
show less