Recipient address rejected: Rejected by SPF: 162.240.166.144 is not a designated mailserver for hidd ...
show moreRecipient address rejected: Rejected by SPF: 162.240.166.144 is not a designated mailserver for hidden%40email.address (context mfrom); Email-subject: Fällig in 2 Tagen; Attachment: Malicious PDF-Invoice
show less
Count: 931
Match: /wp-config.
Referrer: https://www.yahoo.com
Protocol: HTTP/1.1
IP Address: 130 ...
show moreCount: 931
Match: /wp-config.
Referrer: https://www.yahoo.com
Protocol: HTTP/1.1
IP Address: 130.180.235.186
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
show less
Received: from correctiveservices.justice.nsw.gov.au (unknown [141.227.128.178])
This Promo is ju ...
show moreReceived: from correctiveservices.justice.nsw.gov.au (unknown [141.227.128.178])
This Promo is just for you
show less
Sends phishing mails to catch Zimbra login credentials.
===
Lieber E-Mail-Nutzer,=20
Wir ak ...
show moreSends phishing mails to catch Zimbra login credentials.
===
Lieber E-Mail-Nutzer,=20
Wir aktualisieren derzeit unsere Datenbank und unser E-Mail-Kontocenter und=
haben festgestellt, dass Ihre E-Mail-Adresse den =C3=9Cberpr=C3=BCfungs-/A=
ktualisierungsprozess, an dem wir derzeit arbeiten, nicht durchlaufen hat.=
=20
Um maximale Sicherheit im Internet zu gew=C3=A4hrleisten und die Schlie=C3=
=9Fung/L=C3=B6schung Ihres Kontos zu verhindern, sollten Sie es aktualisier=
en, damit wir wissen, dass es sich um Ihr aktuelles Konto handelt. Um die V=
erifizierung Ihres Kontos abzuschlie=C3=9Fen,=20
[ https://xbczim 000webhostapp com/zimbra html | KLICKEN SIE HIER, UM ZU AK=
TUALISIEREN ]=20
Webmaster=20
Zimbra-Administrator=20
show less
According to log, the IP address is trying to send mails from non-existent accounts.
---
From: bry ...
show moreAccording to log, the IP address is trying to send mails from non-existent accounts.
---
From: [email protected]
Subject: Test-Nachricht
Content: Ich teste gerade mein Mail-Postfach.
show less
Received: from a14-59.smtp-out.amazonses.com (a14-59.smtp-out.amazonses.com [54.240.14.59])
From: S ...
show moreReceived: from a14-59.smtp-out.amazonses.com (a14-59.smtp-out.amazonses.com [54.240.14.59])
From: Service Girokonto <[email protected]>
To: [email protected]
subject: [SPAM] Postbankde_38665
Date: Thu, 3 Aug 2023 10:51:28 +0000
Message-ID: <01000189bb061f9e-7f643df6-8421-4756-8012-afb15ef3eb8c-000000@email.amazonses.com>
show less
## Sender
"IT Abteilung" <[email protected]>;
## Body
Lieber E-Mail-Nutzer,
...
show more## Sender
"IT Abteilung" <[email protected]>;
## Body
Lieber E-Mail-Nutzer,
Wir aktualisieren derzeit unsere Datenbank und das E-Mail-Kontocenter und haben festgestellt, dass Ihre E-Mail-Adresse den Überprüfungs-/Aktualisierungsprozess, an dem wir derzeit arbeiten, nicht durchlaufen hat.
Um maximale Sicherheit im Internet zu gewährleisten und die Schließung / Löschung Ihres Kontos zu verhindern, sollten Sie es aktualisieren, damit wir wissen, dass es sich um Ihr Girokonto handelt. Um die Überprüfung Ihres Kontos abzuschließen,
KLICKEN SIE HIER, UM ZU AKTUALISIEREN
Administrator
show less
Subject: =?utf-8?q?DEUTSCHE_POST_DHL_-_Best=C3=A4tigungsprozess_noch_nicht_durchla?=
=?utf-8?q?ufe ...
show moreSubject: =?utf-8?q?DEUTSCHE_POST_DHL_-_Best=C3=A4tigungsprozess_noch_nicht_durchla?=
=?utf-8?q?ufen!?=
To: Hilfe & Kontakt - Deutsche Post DHL <[email protected]>
From: DeutschePost-DHL<[email protected]>
Date: Sat, 08 Oct 2022 13:55:06 +0200
X-Mailer: MIME::Lite 2.117 (F2.6; B2.12; Q2.03)
show less
/wp-admin/admin-ajax.php?action=ave_publishPost&title=random&short=1&term=1&thumb=..%2Fwp-config.php ...
show more/wp-admin/admin-ajax.php?action=ave_publishPost&title=random&short=1&term=1&thumb=..%2Fwp-config.php
/wp-admin/admin-ajax.php?action=..%2Fwp-config.php
/?mdocs-img-preview=wp-config.php
...
show less
Tries to run and checks for malicious scripts like:
/config.bak.php
/error.php?phpshells
/shell ...
show moreTries to run and checks for malicious scripts like:
/config.bak.php
/error.php?phpshells
/shell.php
/config.php
show less
180 attacks in about 2 minutes, tries to run various installers and checks for known vulnerabilities ...
show more180 attacks in about 2 minutes, tries to run various installers and checks for known vulnerabilities via curl like:
///installer.php
///installer-backup.php
/wp/installer.php
///dup-installer/main.installer.php
///dup-installer/main.installer.php
show less
HackingWeb App Attack
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.