文件操作 - 1769896422.M404572P2688613.server.jjexpress.com.my,S=8672,W=8840:2,a
返回文件管理
返回主菜单
删除本文件
文件: /home/jjexpress/mail/cur/1769896422.M404572P2688613.server.jjexpress.com.my,S=8672,W=8840:2,a
编辑文件内容
Return-Path: <takedown-response+81867958@netcraft.com> Delivered-To: jjexpress@server.jjexpress.com.my Received: from server.jjexpress.com.my by server.jjexpress.com.my with LMTP id pGbyF+Z5fmllBikAXt0GIA (envelope-from <takedown-response+81867958@netcraft.com>) for <jjexpress@server.jjexpress.com.my>; Sun, 01 Feb 2026 05:53:42 +0800 Return-path: <takedown-response+81867958@netcraft.com> Envelope-to: webmaster@jjexpress.la Delivery-date: Sun, 01 Feb 2026 05:53:42 +0800 Received: from mail-1c.netcraft.com ([52.31.138.216]:56087) by server.jjexpress.com.my with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.99.1) (envelope-from <takedown-response+81867958@netcraft.com>) id 1vmIuQ-0000000BH5c-06T9 for webmaster@jjexpress.la; Sun, 01 Feb 2026 05:53:42 +0800 Received: from walleye.netcraft.com (unknown [10.9.0.81]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail-1c.netcraft.com (Postfix) with ESMTPS id 514E32E30 for <webmaster@jjexpress.la>; Sat, 31 Jan 2026 21:52:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netcraft.com; s=default202405-yu9bqteb95aqcfpg; t=1769896346; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+Kr9DGIXaZfsmiR9HM6LTARPVzg3v5p6eDZs512JzOo=; b=FuIOHjzPSASCX0bnCfkOYGdP3Qv2CAUOhocgVAsyksEHFTkjoqbzYz4W9sWcVasx/ECOC/ mWQNYViR9eqcwicqZUvieP8S/7/Kfv0Iu1c/m83iaFD2IrbARJH6cP7/bwrDB2An6kfMRh rNKSZo68fgQg/DXfFJ/xy4GCv6oV/vBSaMUdkRDhkdUCdt7IhSeE2u4QvrVsdqdulzkD4S bZIh9x/QrpRNTMN4DnUbHy2qH4oc2G47XACS/CXOn5b33LVo7eiTjyf0M4iNn2i5sKTZod U3dgynB1qZ0zJ2SMaCsbd12YjdFxHF+rA5lW6AM95/P7HNsjb/NyNvXVoqyrjw== Received: by walleye.netcraft.com (Postfix, from userid 507) id 4E03E10BE; Sat, 31 Jan 2026 21:52:26 +0000 (UTC) Content-Transfer-Encoding: 8bit Content-Type: multipart/report; boundary="_----------=_176989634618229642029"; report-type="feedback-report" MIME-Version: 1.0 Date: Sat, 31 Jan 2026 21:52:26 +0000 From: Netcraft Takedown Service <takedown-response+81867958@netcraft.com> Subject: Re: Issue 81867958: Phishing attack at hxxp://jjexpress[.]la/view/ References: <27a05372323957f1cb28384f002a70bc@takedown.netcraft.com> In-Reply-To: <27a05372323957f1cb28384f002a70bc@takedown.netcraft.com> To: webmaster@jjexpress.la Message-Id: <5f3346c27ad681b7eb3c3ef1d6f8f0f5@takedown.netcraft.com> X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13) X-Spam-Status: No, score=3.7 X-Spam-Score: 37 X-Spam-Bar: +++ X-Ham-Report: Spam detection software, running on the system "server.jjexpress.com.my", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Hello, We have discovered a phishing attack on your network. hxxp://jjexpress[.]la/view/ [110.4.40.180] Content analysis details: (3.7 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [52.31.138.216 listed in sa-accredit.habeas.com] -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [52.31.138.216 listed in list.dnswl.org] 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [52.31.138.216 listed in sa-trusted.bondedsender.org] 6.2 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5) [52.31.138.216 listed in bl.mailspike.net] 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [52.31.138.216 listed in bl.score.senderscore.com] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URI: netcraft.com] [URI: xarf.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.0 RCVD_IN_MSPIKE_BL Mailspike blocklisted X-Spam-Flag: NO This is a multi-part message in MIME format. --_----------=_176989634618229642029 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" Hello, We have discovered a phishing attack on your network. hxxp://jjexpress[.]la/view/ [110.4.40.180] We previously contacted you about this issue on 2026-01-30 15:24:34 (UTC). You may not have been aware of this attack, however, you are still responsible for removing it. This attack targets our customer, Microsoft, website URL https://www.microsoft.com/. Please remove this fraudulent content, and any other associated fraudulent content, as soon as possible. Additionally, please keep the fraudulent content safe so that our customer and law enforcement agencies can investigate this incident further once the site is offline. More information about the detected issue is provided at https://incident.netcraft.com/reports/ydrb2e36jams6v7avizfpe See https://incident.netcraft.com/about for more details including API support. Kind regards, Netcraft Phone: +44(0)1225 447500 Fax: +44(0)1225 448600 Netcraft Issue Number: 81867958 To contact us about updates regarding this attack, please respond to this email. Please note: replies to this address will be logged, but aren't always read. If you believe you have received this email in error, or you require further support, please contact: support@netcraft.com. This mail can be parsed with x-arf tools. Visit http://www.xarf.org/ for more information about x-arf. --_----------=_176989634618229642029 Content-Disposition: inline Content-Transfer-Encoding: 7bit Content-Type: message/feedback-report MIME-Version: 1.0 X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13) Date: Sat, 31 Jan 2026 21:52:26 +0000 Feedback-Type: xarf User-Agent: Netcraft Version: 1 --_----------=_176989634618229642029 Content-Disposition: attachment; filename="xarf.json" Content-Transfer-Encoding: base64 Content-Type: application/json; charset=utf-8; name="xarf.json" MIME-Version: 1.0 X-Mailer: MIME::Lite 3.030 (F2.85; T2.17; A2.20; B3.15; Q3.13) Date: Sat, 31 Jan 2026 21:52:26 +0000 eyJSZXBvcnRlckluZm8iOnsiUmVwb3J0ZXJPcmciOiJOZXRjcmFmdCIsIlJlcG9ydGVyT3JnRW1h aWwiOiJ0YWtlZG93bi1yZXNwb25zZSs4MTg2Nzk1OEBuZXRjcmFmdC5jb20iLCJSZXBvcnRlck9y Z0RvbWFpbiI6Im5ldGNyYWZ0LmNvbSJ9LCJWZXJzaW9uIjoiMSIsIlJlcG9ydCI6eyJTb3VyY2VJ cCI6IjExMC40LjQwLjE4MCIsIlJlcG9ydGVyQ2FzZUlEIjoiODE4Njc5NTgiLCJSZXBvcnRlck5v dGVzIjoiU2VlIGh0dHBzOi8vaW5jaWRlbnQubmV0Y3JhZnQuY29tL3JlcG9ydHMveWRyYjJlMzZq YW1zNnY3YXZpemZwZSBmb3IgbW9yZSBpbmZvcm1hdGlvbiIsIkZpcnN0U2VlbiI6IjIwMjYtMDEt MzBUMTU6MjM6MDlaIiwiRGF0ZSI6IjIwMjYtMDEtMzFUMjE6NTA6MjBaIiwiUmVwb3J0Q2xhc3Mi OiJDb250ZW50IiwiUmVwb3J0VHlwZSI6IlBoaXNoaW5nIiwiU291cmNlVXJsIjoiaHR0cDovL2pq ZXhwcmVzcy5sYS92aWV3LyJ9LCJPbkJlaGFsZk9mIjp7IkNvbXBsYWluYW50T3JnRG9tYWluIjoi d3d3Lm1pY3Jvc29mdC5jb20iLCJDb21wbGFpbmFudE9yZ0VtYWlsIjoidGFrZWRvd24tcmVzcG9u c2UrODE4Njc5NThAbmV0Y3JhZnQuY29tIiwiQ29tcGxhaW5hbnRPcmciOiJNaWNyb3NvZnQifSwi RGlzY2xvc3VyZSI6dHJ1ZX0= --_----------=_176989634618229642029--
修改文件时间
将文件时间修改为当前时间的前一年
删除文件