文件操作 - 1769787875.M917597P1096937.server.jjexpress.com.my,S=8813,W=8985:2,a

文件: /home/jjexpress/mail/cur/1769787875.M917597P1096937.server.jjexpress.com.my,S=8813,W=8985:2,a

编辑文件内容

Envelope-to: support@jjexpress.la
Delivery-date: Fri, 30 Jan 2026 23:44:35 +0800
Content-Transfer-Encoding: 8bit
Content-Type: multipart/report; boundary="_----------=_17697878681227410882"; report-type="feedback-report"
MIME-Version: 1.0
Date: Fri, 30 Jan 2026 15:44:28 +0000
From: Netcraft Takedown Service <takedown-response+80604326@netcraft.com>
Subject: Re: Issue 80604326: Phishing attack at hxxps://jjexpress[.]la/view
References: <b056476c1509a70c40181fd6edbd5612@takedown.netcraft.com>
In-Reply-To: <b056476c1509a70c40181fd6edbd5612@takedown.netcraft.com>
To: support@jjexpress.la
Message-Id: <693ceba1d0fe92abd3530c5c6993b843@takedown.netcraft.com>
    
 Content analysis details:   (-0.2 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to DNSWL
                             was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [52.31.138.216 listed in list.dnswl.org]
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URI: xarf.org]
                             [URI: netcraft.com]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                          [52.31.138.216 listed in sa-trusted.bondedsender.org]
  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [52.31.138.216 listed in sa-accredit.habeas.com]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
                             domain
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [52.31.138.216 listed in bl.score.senderscore.com]
X-Spam-Flag: NO

This is a multi-part message in MIME format.

--_----------=_17697878681227410882
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"

Hello,

We have discovered a phishing attack on your network.

hxxp://jjexpress[.]la/view/ [110.4.40.180]
hxxps://jjexpress[.]la/view [110.4.40.180]

We previously contacted you about this issue on 2026-01-07 19:50:51 (UTC).
Since our last notification, the following additional URL(s) have been detected:

hxxp://jjexpress[.]la/view/

You may not have been aware of this attack, however, you are still responsible for removing it.

This attack targets our customer, Adobe, website URL https://www.adobe.com/.

Please remove this fraudulent content, and any other associated fraudulent content, as soon as possible.

Additionally, please keep the fraudulent content safe so that our customer and law enforcement agencies can investigate this incident further once the site is offline.

More information about the detected issue is provided at https://incident.netcraft.com/reports/ttsliv732ugczqqalk5wxz
See https://incident.netcraft.com/about for more details including API support.

Kind regards,

Netcraft

Phone: +44(0)1225 447500
Fax: +44(0)1225 448600
Netcraft Issue Number: 80604326

To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com.

This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf.
--_----------=_17697878681227410882
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
Content-Type: message/feedback-report
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Fri, 30 Jan 2026 15:44:28 +0000

Feedback-Type: xarf
User-Agent: Netcraft
Version: 1
--_----------=_17697878681227410882
Content-Disposition: attachment; filename="xarf.json"
Content-Transfer-Encoding: base64
Content-Type: application/json; charset=utf-8; name="xarf.json"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13)
Date: Fri, 30 Jan 2026 15:44:28 +0000

eyJSZXBvcnRlckluZm8iOnsiUmVwb3J0ZXJPcmdFbWFpbCI6InRha2Vkb3duLXJlc3BvbnNlKzgw
NjA0MzI2QG5ldGNyYWZ0LmNvbSIsIlJlcG9ydGVyT3JnRG9tYWluIjoibmV0Y3JhZnQuY29tIiwi
UmVwb3J0ZXJPcmciOiJOZXRjcmFmdCJ9LCJEaXNjbG9zdXJlIjp0cnVlLCJWZXJzaW9uIjoiMSIs
Ik9uQmVoYWxmT2YiOnsiQ29tcGxhaW5hbnRPcmdFbWFpbCI6InRha2Vkb3duLXJlc3BvbnNlKzgw
NjA0MzI2QG5ldGNyYWZ0LmNvbSIsIkNvbXBsYWluYW50T3JnIjoiQWRvYmUiLCJDb21wbGFpbmFu
dE9yZ0RvbWFpbiI6Ind3dy5hZG9iZS5jb20ifSwiUmVwb3J0Ijp7IkRhdGUiOiIyMDI2LTAxLTMw
VDE1OjIyOjMyWiIsIlNvdXJjZVVybCI6Imh0dHBzOi8vampleHByZXNzLmxhL3ZpZXciLCJGaXJz
dFNlZW4iOiIyMDI2LTAxLTA2VDEzOjAzOjE4WiIsIlJlcG9ydGVyTm90ZXMiOiJTZWUgaHR0cHM6
Ly9pbmNpZGVudC5uZXRjcmFmdC5jb20vcmVwb3J0cy90dHNsaXY3MzJ1Z2N6cXFhbGs1d3h6IGZv
ciBtb3JlIGluZm9ybWF0aW9uIiwiU291cmNlSXAiOiIxMTAuNC40MC4xODAiLCJSZXBvcnRlckNh
c2VJRCI6IjgwNjA0MzI2IiwiUmVwb3J0VHlwZSI6IlBoaXNoaW5nIiwiUmVwb3J0Q2xhc3MiOiJD
b250ZW50In19

--_----------=_17697878681227410882--

文件操作 - 1769787875.M917597P1096937.server.jjexpress.com.my,S=8813,W=8985:2,a

文件: /home/jjexpress/mail/cur/1769787875.M917597P1096937.server.jjexpress.com.my,S=8813,W=8985:2,a

编辑文件内容

修改文件时间

删除文件