Hacked By AnonymousFox

Current Path : /proc/thread-self/root/home/allslyeo/mail/zombie.wtf/info/new/
Current File : //proc/thread-self/root/home/allslyeo/mail/zombie.wtf/info/new/1716894986.M876552P1015023.business33.web-hosting.com,S=7280,W=7422
Envelope-to: info@zombie.wtf
Delivery-date: Tue, 28 May 2024 07:16:26 -0400
Content-Transfer-Encoding: 8bit
Content-Type: multipart/report; boundary="_----------=_171689489421297269843"; report-type="feedback-report"
MIME-Version: 1.0
Date: Tue, 28 May 2024 11:14:54 +0000
From: Netcraft Takedown Service <takedown-response+56482953@netcraft.com>
Subject: Issue 56482953: Malicious web shell at hxxps://zombie[.]wtf/wp-admin/4muGsRoSBq3.php
To: info@zombie.wtf
Message-Id: <06804b1498f3fdd0d0af7bc2739d91eb@takedown.netcraft.com>
    
 Content analysis details:   (-0.2 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: xarf.org]
  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                          [52.31.138.216 listed in sa-trusted.bondedsender.org]
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.0 T_SCC_BODY_TEXT_LINE   No description available.
X-Spam-Flag: NO

This is a multi-part message in MIME format.

--_----------=_171689489421297269843
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"

Hello,

We have discovered a malicious web shell being hosted on your network:

hxxps://zombie[.]wtf/wp-admin/4muGsRoSBq3.php [198.54.116.167]

Web shells are scripts that attackers upload to compromised web-servers in order to gain remote access. When accessed using a web browser, web shells can allow attackers to upload files, execute arbitrary commands on the server, and send spam. Web shells are often used to create phishing or malware attacks on the compromised server.

Attackers often attempt to disguise web shells as benign pages. Common techniques include returning a fake 404 page and making the web shell input fields on the page invisible. Please check the attacker is not attempting to hide the web shell before dismissing this report.

More information about the detected issue is provided at https://incident.netcraft.com/96325f265864/

Kind regards,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 56482953

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: takedown@netcraft.com.

This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.
--_----------=_171689489421297269843
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Tue, 28 May 2024 11:14:54 +0000

Feedback-Type: xarf
User-Agent: Netcraft
Version: 1
--_----------=_171689489421297269843
Content-Disposition: attachment; filename="xarf.json"
Content-Transfer-Encoding: base64
Content-Type: application/json; charset=utf-8; name="xarf.json"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Tue, 28 May 2024 11:14:54 +0000

eyJSZXBvcnRlckluZm8iOnsiUmVwb3J0ZXJPcmdFbWFpbCI6InRha2Vkb3duLXJlc3BvbnNlKzU2
NDgyOTUzQG5ldGNyYWZ0LmNvbSIsIlJlcG9ydGVyT3JnIjoiTmV0Y3JhZnQiLCJSZXBvcnRlck9y
Z0RvbWFpbiI6Im5ldGNyYWZ0LmNvbSJ9LCJSZXBvcnQiOnsiUmVwb3J0ZXJDYXNlSUQiOiI1NjQ4
Mjk1MyIsIlJlcG9ydGVyTm90ZXMiOiJTZWUgaHR0cHM6Ly9pbmNpZGVudC5uZXRjcmFmdC5jb20v
OTYzMjVmMjY1ODY0LyBmb3IgbW9yZSBpbmZvcm1hdGlvbiIsIkRhdGUiOiIyMDI0LTA1LTI4VDEx
OjEzOjEyWiIsIlJlcG9ydENsYXNzIjoiQ29udGVudCIsIlNvdXJjZVVybCI6Imh0dHBzOi8vem9t
YmllLnd0Zi93cC1hZG1pbi80bXVHc1JvU0JxMy5waHAiLCJSZXBvcnRUeXBlIjoiTWFsd2FyZSIs
IlNvdXJjZUlwIjoiMTk4LjU0LjExNi4xNjcifSwiVmVyc2lvbiI6IjEiLCJPbkJlaGFsZk9mIjp7
IkNvbXBsYWluYW50T3JnRW1haWwiOiJ0YWtlZG93bi1yZXNwb25zZSs1NjQ4Mjk1M0BuZXRjcmFm
dC5jb20iLCJDb21wbGFpbmFudE9yZ0RvbWFpbiI6Im5ldGNyYWZ0LmNvbSIsIkNvbXBsYWluYW50
T3JnIjoiRGVmYWNlZCBTaXRlIn0sIkRpc2Nsb3N1cmUiOnRydWV9

--_----------=_171689489421297269843--
Hacked By AnonymousFox1.0, Coded By AnonymousFox