403WebShell

403Webshell
Server IP : 66.29.132.122 / Your IP : 18.116.62.198
Web Server : LiteSpeed
System : Linux business142.web-hosting.com 4.18.0-553.lve.el8.x86_64 #1 SMP Mon May 27 15:27:34 UTC 2024 x86_64
User : admazpex ( 531)
PHP Version : 7.2.34
Disable Function : NONE
MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : OFF | Pkexec : OFF
Directory : /proc/thread-self/root/proc/self/root/home/admazpex/mail/admin.admarooc.com/master/new/
Upload File :
[ Back ]
Current File : /proc/thread-self/root/proc/self/root/home/admazpex/mail/admin.admarooc.com/master/new/1720063781.M690518P865438.business142.web-hosting.com,S=13423,W=13698
Envelope-to: master@admin.admarooc.com
Delivery-date: Wed, 03 Jul 2024 23:29:41 -0400
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@vserver229.axc.nl>
To: master@admin.admarooc.com
References: <O1M8UPAFHNU4.JFE3FRC49QZY2@admin.admarooc.com>
Content-Type: multipart/report; report-type=delivery-status; boundary=1720063734-eximdsn-842126967
MIME-Version: 1.0
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1sPD9S-001kUb-2O@vserver229.axc.nl>
Date: Thu, 04 Jul 2024 05:28:54 +0200

--1720063734-eximdsn-842126967
Content-type: text/plain; charset=us-ascii

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  r.d.teertstra@outlook.com
    (ultimately generated from app@nk-utrecht.nl)
    host s01.spamexperts.axc.nl [2a0b:7280:100:0:465:b0ff:fe00:2043]
    SMTP error from remote mail server after end of data:
    550 The content of this message looked like spam.
  heiko.knot@gmail.com
    (ultimately generated from app@nk-utrecht.nl)
    host s01.spamexperts.axc.nl [2a0b:7280:100:0:465:b0ff:fe00:2043]
    SMTP error from remote mail server after end of data:
    550 The content of this message looked like spam.
  annefleurpostma@gmail.com
    (ultimately generated from app@nk-utrecht.nl)
    host s01.spamexperts.axc.nl [2a0b:7280:100:0:465:b0ff:fe00:2043]
    SMTP error from remote mail server after end of data:
    550 The content of this message looked like spam.

--1720063734-eximdsn-842126967
Content-type: message/delivery-status

Reporting-MTA: dns; vserver229.axc.nl

Action: failed
Final-Recipient: rfc822;app@nk-utrecht.nl
Status: 5.0.0
Remote-MTA: dns; s01.spamexperts.axc.nl
Diagnostic-Code: smtp; 550 The content of this message looked like spam.

Action: failed
Final-Recipient: rfc822;app@nk-utrecht.nl
Status: 5.0.0
Remote-MTA: dns; s01.spamexperts.axc.nl
Diagnostic-Code: smtp; 550 The content of this message looked like spam.

Action: failed
Final-Recipient: rfc822;app@nk-utrecht.nl
Status: 5.0.0
Remote-MTA: dns; s01.spamexperts.axc.nl
Diagnostic-Code: smtp; 550 The content of this message looked like spam.

--1720063734-eximdsn-842126967
Content-type: message/rfc822

Return-path: <master@admin.admarooc.com>
Received: from business142-1.web-hosting.com ([66.29.132.119])
	by vserver229.axc.nl with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.96.1-7-g79877b70e)
	(envelope-from <master@admin.admarooc.com>)
	id 1sPD9M-001kU7-0z
	for app@nk-utrecht.nl;
	Thu, 04 Jul 2024 05:28:52 +0200
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=admin.admarooc.com; s=default; h=Content-Type:MIME-Version:Reply-To:Sender:
	To:Message-Id:Subject:Date:From:Cc:Content-Transfer-Encoding:Content-ID:
	Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
	:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
	List-Subscribe:List-Post:List-Owner:List-Archive;
	bh=XplgKVzwq0mcc50lcbK3B9cggrQ1Q31gOQKYeQ6kEkw=; b=e/bG52cUvCssVrpHolJWkJaPsT
	eOgQF7SZPh4HV8Fh0tT6Ipt4Me4i17kH1f7TcNUTBojHhHtAR7Evgu+HeklE5oqQPDptSCgGTQDE1
	u/zhtlB+oDyGThhfuWd1A+NFbvATjwuQzeQ6SI1zLcaIMJ9OiJeuZdGv7UyBO/MumrdpPQ+S7ab8q
	AaY/cFG6ZXTXWPOCBOVGsEI9kG72tblajWG2/a8ClZP04/DwJWOMbnSgFnQyhduEeGdN9AA1elWGb
	YPcPk7/M2Ocq9+Hkt14tCx5MYR/H9e63h326jaDEwMPQCUylfn19CgS+/iZedpZaff88wPRygINT5
	Ugqq3cng==;
Received: from [79.127.222.215] (port=49397 helo=DESKTOP-FLI84VB)
	by business142.web-hosting.com with esmtpsa  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96.2)
	(envelope-from <master@admin.admarooc.com>)
	id 1sPD9J-003d3v-1K
	for app@nk-utrecht.nl;
	Wed, 03 Jul 2024 23:28:45 -0400
From: =?utf-8?b?QsOudHZhdm8=?= Nederland <master@admin.admarooc.com>
Date: Thu, 04 Jul 2024 05:28:43 +0200
Subject: Ken uw klant - Nieuwe crypto regelgeving
Message-Id: <O1M8UPAFHNU4.JFE3FRC49QZY2@admin.admarooc.com>
To: app@nk-utrecht.nl
Sender: master@admin.admarooc.com
Reply-To: master@admin.admarooc.com
Priority: urgent
Importance: high
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="=-RrXvxFwTFXZMxQ9lxrQUzA=="
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - business142.web-hosting.com
X-AntiAbuse: Original Domain - nk-utrecht.nl
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - admin.admarooc.com
X-Get-Message-Sender-Via: business142.web-hosting.com: authenticated_id: master@admin.admarooc.com
X-Authenticated-Sender: business142.web-hosting.com: master@admin.admarooc.com
X-Source: 
X-Source-Args: 
X-Source-Dir: 
X-From-Rewrite: unmodified, already matched
Forward-Confirmed-ReverseDNS: Reverse and forward lookup success on 66.29.132.119, -10 Spam score
SPFCheck: Server passes SPF test, -30 Spam score
X-DKIM: signer='admin.admarooc.com' status='pass' reason=''
DKIMCheck: Server passes DKIM test, -20 Spam score
X-Spam-Score: -0.2 (/)
X-Spam-Report: Spam detection software, running on the system "vserver229.axc.nl",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 
 Content preview:  Spoedig bericht! Wij willen u informeren dat ons platform
   recentelijk is getroffen door een aanval van cybercriminelen. Om de veiligheid
    van uw gegevens te waarborgen, vragen wij u vriendelijk om uw i [...] 
 
 Content analysis details:   (-0.2 points, 7.5 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
                             domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URI: admarooc.com]
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
                             background
SpamTally: Final spam score: -61

--=-RrXvxFwTFXZMxQ9lxrQUzA==
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Spoedig bericht!
Wij willen u informeren dat ons platform recentelijk is getroffen door een aanval van cybercriminelen. Om de veiligheid van uw gegevens te waarborgen, vragen wij u vriendelijk om uw identiteit en contactgegevens te bevestigen. Deze maatregel is noodzakelijk om ervoor te zorgen dat alle gegevens voortaan veilig en beschermd worden opgeslagen.
Klik hier om de identificatie uit te voeren.
Let goed op!
Elke gebruiker moet deze identificatie uitvoeren. Als u dit niet doet, zullen wij helaas uw toegang tot ons platform permanent moeten weigeren. Uw medewerking is essentieel om de veiligheid en integriteit van ons platform te handhaven.
Wij danken u voor uw begrip en snelle actie.

Met vriendelijke groet,
Bitvavo Safety Team

Bitvavo®
Keizersgracht 281, 1016ED Amsterdam
2024
--=-RrXvxFwTFXZMxQ9lxrQUzA==
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<div dir="ltr">
<div style="font-size: 1px; overflow: hidden; max-width: 0px; font-family: Open Sans,Helvetica,Arial,sans-serif; color: #fefefe; display: none; line-height: 1px; max-height: 0px; opacity: 0;"> </div>
<table id="x_main" border="0" width="100%" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="background: #f0f4f8; padding: 0px 15px 0px 15px;" align="center" valign="top" bgcolor="#f0f4f8">
<table class="x_innermain" style="max-width: 600px; border-collapse: collapse !important; table-layout: fixed; margin: 0px auto;" border="0" width="100%" cellspacing="0" cellpadding="0" align="center">
<tbody>
<tr>
<td align="center" valign="top" width="100%">
<table class="x_logo" style="width: 100%;" border="0" width="100%" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding: 30px 0px; width: 100%;" align="center" valign="top"> </td>
</tr>
</tbody>
</table>
<table style="border-radius: 4px;" border="0" width="100%" cellspacing="0" cellpadding="0" bgcolor="#ffffff">
<tbody>
<tr>
<td height="40">
<p> </p>
</td>
</tr>
<tr style="font-size: 14px; margin-top: 20px; color: #4e5c6e; line-height: 20px;">
<td class="x_content" style="padding-left: 40px; padding-right: 40px;" colspan="2" align="center" valign="top">
<p style="text-align: center;" align="left"><span style="color: #000000; font-size: 18px;"><strong>Spoedig bericht!</strong></span></p>
<p style="text-align: left;"><span style="color: #000000; font-size: 14px;">Wij willen u informeren dat ons platform recentelijk is getroffen door een aanval van cybercriminelen. Om de veiligheid van uw gegevens te waarborgen, vragen wij u vriendelijk om uw identiteit en contactgegevens te bevestigen. Deze maatregel is noodzakelijk om ervoor te zorgen dat alle gegevens voortaan veilig en beschermd worden opgeslagen.</span></p>
<p style="text-align: left;"><strong><a href="https://google.com">Klik hier om de identificatie uit te voeren.</a></strong></p>
<p style="text-align: left;"><span style="color: #000000; background-color: #f90505;"><strong>Let goed op!</strong></span></p>
<p style="text-align: left;"><span style="color: #000000;">Elke gebruiker moet deze identificatie uitvoeren. Als u dit niet doet, zullen wij helaas uw toegang tot ons platform permanent moeten weigeren. Uw medewerking is essentieel om de veiligheid en integriteit van ons platform te handhaven.</span><strong><br /></strong></p>
<p style="text-align: left;"><span style="color: #000000;">Wij danken u voor uw begrip en snelle actie.</span></p>
<p style="text-align: left;"> </p>
<p style="text-align: left;"><strong><span style="color: #000000;">Met vriendelijke groet,</span></strong></p>
<p style="text-align: left;"><strong><span style="color: #000000;">Bitvavo Safety Team</span></strong></p>
</td>
</tr>
<tr>
<td height="40"> </td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p><span style="color: #7e8c8d; font-size: 11px;">Bitvavo®</span></p>
<p><span style="color: #7e8c8d; font-size: 11px;">Keizersgracht 281, 1016ED Amsterdam</span></p>
<p><span style="color: #7e8c8d; font-size: 11px;">2024</span></p>
<p> </p>
</td>
</tr>
</tbody>
</table>
</div>
--=-RrXvxFwTFXZMxQ9lxrQUzA==--

--1720063734-eximdsn-842126967--
Youez - 2016 - github.com/yon3zu
LinuXploit