# logs

timestamp: 2026-04-07 19:48:29
decky: decky-webmail
service: smtp
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:48:29.520153+00:00 decky-webmail smtp - startup - SMTP server starting as decky-webmail


timestamp: 2026-04-07 19:48:29
decky: decky-webmail
service: imap
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:48:29.525953+00:00 decky-webmail imap - startup - IMAP server starting as decky-webmail


timestamp: 2026-04-07 19:48:29
decky: decky-webmail
service: pop3
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:48:29.531525+00:00 decky-webmail pop3 - startup - POP3 server starting as decky-webmail


timestamp: 2026-04-07 19:48:29
decky: decky-webmail
service: http
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:48:29.562070+00:00 decky-webmail http - startup - HTTP server starting as decky-webmail


timestamp: 2026-04-07 19:53:05
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:05.202133+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="56394"]


timestamp: 2026-04-07 19:53:05
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:05.202095+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="44836"]


timestamp: 2026-04-07 19:53:05
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:05.202120+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="49892"]


timestamp: 2026-04-07 19:53:05
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:05.204537+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-07 19:53:11
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:11.208384+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="GET / HTTP/1.0"]


timestamp: 2026-04-07 19:53:11
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:11.208384+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd=""]


timestamp: 2026-04-07 19:53:11
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:11.208646+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd=""]


timestamp: 2026-04-07 19:53:11
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:11.208787+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{}" body=""]


timestamp: 2026-04-07 19:53:16
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:16.213731+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-07 19:53:16
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:16.213827+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-07 19:53:16
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:16.214094+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="51296"]


timestamp: 2026-04-07 19:53:16
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:16.214133+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="50426"]


timestamp: 2026-04-07 19:53:16
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:16.214228+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="OPTIONS / HTTP/1.0"]


timestamp: 2026-04-07 19:53:16
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:16.214301+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd=""]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:21.219340+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-07T19:53:21.219334+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:21.222956+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{}" body=""]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:21.223266+00:00 decky-webmail http - request [decnet@55555 method="POST" path="/sdk" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'Content-Length': '441', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body="<soap:Envelope xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Header><operationID>00000001-00000001</operationID></soap:Header><soap:Body><RetrieveServiceContent xmlns=\"urn:internalvim25\"><_this xsi:type=\"ManagedObjectReference\" type=\"ServiceInstance\">ServiceInstance</_this></RetrieveServiceContent></soap:Body></soap:Envelope>"]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:21.223437+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/nmaplowercheck1775591601" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:21.224651+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/NmapUpperCheck1775591601" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:21.225177+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/Nmap/folder/check1775591601" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:21.225909+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{}" body=""]


timestamp: 2026-04-07 19:53:21
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T19:53:21.226287+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110'}" body=""]


timestamp: 2026-04-07 20:24:03
decky: decky-webmail
service: smtp
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T20:24:03.279897+00:00 decky-webmail smtp - startup - SMTP server starting as decky-webmail


timestamp: 2026-04-07 20:24:03
decky: decky-webmail
service: imap
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T20:24:03.279954+00:00 decky-webmail imap - startup - IMAP server starting as decky-webmail


timestamp: 2026-04-07 20:24:03
decky: decky-webmail
service: pop3
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T20:24:03.283256+00:00 decky-webmail pop3 - startup - POP3 server starting as decky-webmail


timestamp: 2026-04-07 20:24:03
decky: decky-webmail
service: http
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-07T20:24:03.297543+00:00 decky-webmail http - startup - HTTP server starting as decky-webmail


timestamp: 2026-04-08 02:34:14
decky: decky-webmail
service: http
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:34:14.252618+00:00 decky-webmail http - startup - HTTP server starting as decky-webmail


timestamp: 2026-04-08 02:34:14
decky: decky-webmail
service: smtp
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:34:14.394371+00:00 decky-webmail smtp - startup - SMTP server starting as decky-webmail


timestamp: 2026-04-08 02:34:14
decky: decky-webmail
service: imap
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:34:14.544200+00:00 decky-webmail imap - startup - IMAP server starting as decky-webmail


timestamp: 2026-04-08 02:34:14
decky: decky-webmail
service: pop3
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:34:14.613141+00:00 decky-webmail pop3 - startup - POP3 server starting as decky-webmail


timestamp: 2026-04-08 02:41:44
decky: decky-webmail
service: smtp
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:41:44.704390+00:00 decky-webmail smtp - startup - SMTP server starting as decky-webmail


timestamp: 2026-04-08 02:41:44
decky: decky-webmail
service: pop3
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:41:44.712319+00:00 decky-webmail pop3 - startup - POP3 server starting as decky-webmail


timestamp: 2026-04-08 02:41:44
decky: decky-webmail
service: imap
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:41:44.715798+00:00 decky-webmail imap - startup - IMAP server starting as decky-webmail


timestamp: 2026-04-08 02:41:44
decky: decky-webmail
service: http
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T02:41:44.761105+00:00 decky-webmail http - startup - HTTP server starting as decky-webmail


timestamp: 2026-04-08 03:04:58
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:04:58.479955+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="59596"]


timestamp: 2026-04-08 03:04:58
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:04:58.479908+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="50740"]


timestamp: 2026-04-08 03:04:58
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:04:58.479944+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="60948"]


timestamp: 2026-04-08 03:04:58
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:04:58.482589+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:04
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:04.485896+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd=""]


timestamp: 2026-04-08 03:05:04
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:04.485896+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="GET / HTTP/1.0"]


timestamp: 2026-04-08 03:05:04
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:04.486195+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd=""]


timestamp: 2026-04-08 03:05:04
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:04.486265+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{}" body=""]


timestamp: 2026-04-08 03:05:09
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:09.490954+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:09
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:09.491082+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:09
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:09.491362+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="50502"]


timestamp: 2026-04-08 03:05:09
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:09.491458+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="36034"]


timestamp: 2026-04-08 03:05:09
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:09.491503+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="OPTIONS / HTTP/1.0"]


timestamp: 2026-04-08 03:05:09
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:09.491587+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd=""]


timestamp: 2026-04-08 03:05:14
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:14.497117+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:14
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:14.497128+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.778507+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="57398"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.778969+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="57412"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.780606+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="36044"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.786241+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="50504"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.786522+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="50510"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.787287+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="57414"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788057+00:00 decky-webmail http - request [decnet@55555 method="POST" path="/sdk" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Content-Length': '441', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body="<soap:Envelope xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Header><operationID>00000001-00000001</operationID></soap:Header><soap:Body><RetrieveServiceContent xmlns=\"urn:internalvim25\"><_this xsi:type=\"ManagedObjectReference\" type=\"ServiceInstance\">ServiceInstance</_this></RetrieveServiceContent></soap:Body></soap:Envelope>"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788277+00:00 decky-webmail http - request [decnet@55555 method="PROPFIND" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Depth': '0', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788579+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788832+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.789126+00:00 decky-webmail http - request [decnet@55555 method="PROPFIND" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Depth': '0', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.789433+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/.git/HEAD" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.791597+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="STLS"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.789747+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788454+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'HEAD'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.789250+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/nmaplowercheck1775617515" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788723+00:00 decky-webmail http - request [decnet@55555 method="POST" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Content-Type': 'application/x-www-form-urlencoded', 'Connection': 'close', 'Content-Length': '88'}" body="<methodCall> <methodName>system.listMethods</methodName> <params></params> </methodCall>"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.789635+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788996+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/robots.txt" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: ehlo
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.795508+00:00 decky-webmail smtp - ehlo [decnet@55555 src="192.168.1.5" domain="nmap.scanme.org"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: ehlo
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.795759+00:00 decky-webmail smtp - ehlo [decnet@55555 src="192.168.1.5" domain="nmap.scanme.org"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: ehlo
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.795842+00:00 decky-webmail smtp - ehlo [decnet@55555 src="192.168.1.5" domain="nmap.scanme.org"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.796119+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.796206+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: unknown_command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.796294+00:00 decky-webmail smtp - unknown_command [decnet@55555 src="192.168.1.5" command="HELP"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.796361+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="AUTH NTLM"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796438+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'GET'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796615+00:00 decky-webmail http - request [decnet@55555 method="PROPFIND" path="/" remote_addr="192.168.1.5" headers="{'Depth': '1', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Content-Length': '0', 'Connection': 'close', 'Host': '192.168.1.110'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796792+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/NmapUpperCheck1775617515" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796942+00:00 decky-webmail http - request [decnet@55555 method="PLEU" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.798138+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.798209+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.798273+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.798346+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.800770+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="36046"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.800943+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="57418"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.800994+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'POST'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.798121+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="TlRMTVNTUAABAAAAB4IIoAAAAAAAAAAAAAAAAAAAAAA="]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.801454+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: ehlo
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.801656+00:00 decky-webmail smtp - ehlo [decnet@55555 src="192.168.1.5" domain="nmap.scanme.org"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.801600+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/Nmap/folder/check1775617515" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.801764+00:00 decky-webmail http - request [decnet@55555 method="POST" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Content-Length': '0', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.802579+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="36056"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: auth_attempt
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.802672+00:00 decky-webmail smtp - auth_attempt [decnet@55555 src="192.168.1.5" command="AUTH NTLM"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.802794+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.802586+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'PUT'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.802776+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/favicon.ico" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.806436+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="000b AUTHENTICATE NTLM"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.806511+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="50526"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.806571+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'DELETE'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.806924+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="STLS"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.806923+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="TlRMTVNTUAABAAAAB4IIoAAAAAAAAAAAAAAAAAAAAAA="]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.807082+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'TRACE'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.810419+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.810466+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.810532+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.810761+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'OPTIONS'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.813097+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'CONNECT'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.817009+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'PATCH'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.828253+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="57434"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: ehlo
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.828499+00:00 decky-webmail smtp - ehlo [decnet@55555 src="192.168.1.5" domain="nmap.scanme.org"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.828518+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.829131+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110'}" body=""]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.829468+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.829643+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="57444"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.844265+00:00 decky-webmail smtp - connect [decnet@55555 src="192.168.1.5" src_port="57454"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.844481+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: smtp
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.844597+00:00 decky-webmail smtp - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.844682+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="36068"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845057+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="36082"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845197+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="($9���O
  X1��U�:5u���>
  �+7
  �%� II=%b�Tz��_
  �/���[�o�Q�r395/�,�0�̨̩̪�����\]�a�S�+�/������\\�`�R"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845325+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="���	�E����Q����P=�<��Ai�
  "]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845403+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="
  ���
  
  #
  (&				"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845469+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="
  +-3����"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845543+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="�Y���B���!rt�'�-^Pz��V���F��I���٫l��y;�v�
  Vv%���ɛ�jF�/E�����
  �7\"2�4[��1ʲ&�0l
  �?*%��LUt$ATVV�E���Ӗ�+���\]�
  �+�'(�"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845624+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="�y
  P�RG���fI��NY����ovpЈ�[:�G�����"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845689+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="	*�b/O��v�`x\";t$*;l�B\"��*�)��Ȣ�a�q��Ō��A��+��d��Ie�mÚ�{Q��y����24�~��V�`B�!��W\"��/zʿ(��f��	����8jU��Rw5�CR��4����"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.846888+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="�AU��`��R/S2��:�hB˦��Wz@%E��v\"c���mcW��Q{�Y_X
  ��mz"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.846967+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="���?ʐ����'*U<w<�#u��"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847038+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="qT�D��%�ɴ�o�Z�H7Zҹ\\���*g�P~����^���^*�)9�8{jt�(stÓ@b�PWO�$�	�иn�	CqiC�TVlu��cK�Y3�IR5�P�
  �y��y���h�k���iB
  j"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847122+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="�C
  ~�w�;mz�f���_�0
  �d��ԅͣ�a2���ba��x�\]aE}�@�}��Yqf\";��|�����?�
  W豇����*�eI�d�9@�	�O�0��ft�8UG\"���\]i�!o��m�!��E�0�up�"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847257+00:00 decky-webmail imap - connect [decnet@55555 src="192.168.1.5" src_port="36088"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847363+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="WSi����iI��
  ,��R�?�g�{MG���Xӛ"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847455+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="/"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847548+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847643+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847712+00:00 decky-webmail imap - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847592+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="50528"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847858+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="STLS"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847971+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848073+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="50534"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848153+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="($6�Ě�57�П8�~)��L��\\\"97�_� ;?�\\a@�Z:�i�Ĵo����)P�v����xr395/�,�0�̨̩̪�����\]�a�S�+�/������\\�`�R�$�"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848241+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="���	�E����Q����P=�<��Ai�
  "]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848301+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="
  ���
  
  #
  (&				"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848356+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="
  +-3�����O����V�j!x[%�D��<��2�9��8M�Q��������es!?�7����j�
  	��6@"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848415+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="�
  �^V�l�
  �t݄�(e=I+'C��)���B��LH.	w_	ԝ��	�rN�
  ��1�Q-v���O�5�Fi.$��C/��ޢ5�~��RИu\"j�d4���[�!�"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848468+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="�E��F;�wn�i���Ta���G�vA��+�:�
  �:�a[��'8"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848525+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="?�F�ϖ!\"�aԖ/��B���\\��i�񛼷-xo��ƥU.a�{=Eb�B\]�498�-�J?{����'DiZ)	E�ۦ��P�'�丹24���VV��.Д&^���V�bZ������)2@r� �,"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848594+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="'t�����>����iw�`�ɇ�eIh�TFf,'���a0'�n���kGc�
  !J3�v�j��2[��PP��:�z���*�����y,��ʞJ�[RX�A��`��!̓���+���kiޔ;,�8*ߡw���z�2�"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848649+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="1v�����:�5�VP�t�Ѳ��a[z�z�{B~cm�2Q,x>"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848705+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="-T�'��+$������,-Nѹ$v2���sĳ¶��B��%���Ĺ�9P�'%Q�p�qk�s/���@D8
  I|M�z�ທ疓�l�
  ��;
  �˪���E<�i�q�8?ͺ�?)^q0��J�#���u���F#\\b�|���{�"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: connect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848801+00:00 decky-webmail pop3 - connect [decnet@55555 src="192.168.1.5" src_port="50550"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848882+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="WSi��뎱sr�`	�B
  @�&��cG|$G�͒
  �/�"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848949+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="/"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.849007+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: disconnect
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.849061+00:00 decky-webmail pop3 - disconnect [decnet@55555 src="192.168.1.5"]


timestamp: 2026-04-08 03:21:44
decky: decky-webmail
service: http
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:21:44.871598+00:00 decky-webmail http - startup - HTTP server starting as decky-webmail


timestamp: 2026-04-08 03:21:44
decky: decky-webmail
service: smtp
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:21:44.905490+00:00 decky-webmail smtp - startup - SMTP server starting as decky-webmail


timestamp: 2026-04-08 03:21:44
decky: decky-webmail
service: imap
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:21:44.944053+00:00 decky-webmail imap - startup - IMAP server starting as decky-webmail


timestamp: 2026-04-08 03:21:45
decky: decky-webmail
service: pop3
event_type: startup
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:21:45.112633+00:00 decky-webmail pop3 - startup - POP3 server starting as decky-webmail


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788057+00:00 decky-webmail http - request [decnet@55555 method="POST" path="/sdk" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Content-Length': '441', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body="<soap:Envelope xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Header><operationID>00000001-00000001</operationID></soap:Header><soap:Body><RetrieveServiceContent xmlns=\"urn:internalvim25\"><_this xsi:type=\"ManagedObjectReference\" type=\"ServiceInstance\">ServiceInstance</_this></RetrieveServiceContent></soap:Body></soap:Envelope>"]

fields:
  {"method": "POST", "path": "/sdk", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Content-Length': '441', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": "<soap:Envelope xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Header><operationID>00000001-00000001</operationID></soap:Header><soap:Body><RetrieveServiceContent xmlns=\"urn:internalvim25\"><_this xsi:type=\"ManagedObjectReference\" type=\"ServiceInstance\">ServiceInstance</_this></RetrieveServiceContent></soap:Body></soap:Envelope>"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788277+00:00 decky-webmail http - request [decnet@55555 method="PROPFIND" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Depth': '0', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "PROPFIND", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Depth': '0', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788579+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "GET", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788832+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.789433+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/.git/HEAD" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "GET", "path": "/.git/HEAD", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788454+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'HEAD'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'HEAD'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.789250+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/nmaplowercheck1775617515" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "GET", "path": "/nmaplowercheck1775617515", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788723+00:00 decky-webmail http - request [decnet@55555 method="POST" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Content-Type': 'application/x-www-form-urlencoded', 'Connection': 'close', 'Content-Length': '88'}" body="<methodCall> <methodName>system.listMethods</methodName> <params></params> </methodCall>"]

fields:
  {"method": "POST", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Content-Type': 'application/x-www-form-urlencoded', 'Connection': 'close', 'Content-Length': '88'}", "body": "<methodCall> <methodName>system.listMethods</methodName> <params></params> </methodCall>"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.788996+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/robots.txt" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "GET", "path": "/robots.txt", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796438+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'GET'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'GET'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796615+00:00 decky-webmail http - request [decnet@55555 method="PROPFIND" path="/" remote_addr="192.168.1.5" headers="{'Depth': '1', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Content-Length': '0', 'Connection': 'close', 'Host': '192.168.1.110'}" body=""]

fields:
  {"method": "PROPFIND", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Depth': '1', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Content-Length': '0', 'Connection': 'close', 'Host': '192.168.1.110'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796792+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/NmapUpperCheck1775617515" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "GET", "path": "/NmapUpperCheck1775617515", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.796942+00:00 decky-webmail http - request [decnet@55555 method="PLEU" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "PLEU", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.800994+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'POST'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'POST'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.801600+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/Nmap/folder/check1775617515" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "GET", "path": "/Nmap/folder/check1775617515", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.801764+00:00 decky-webmail http - request [decnet@55555 method="POST" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Content-Length': '0', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "POST", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Content-Length': '0', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.802586+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'PUT'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'PUT'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.802776+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/favicon.ico" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}" body=""]

fields:
  {"method": "GET", "path": "/favicon.ico", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Connection': 'close', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.806571+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'DELETE'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'DELETE'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.807082+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'TRACE'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'TRACE'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.810761+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'OPTIONS'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'OPTIONS'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.813097+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'CONNECT'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'CONNECT'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.817009+00:00 decky-webmail http - request [decnet@55555 method="OPTIONS" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'PATCH'}" body=""]

fields:
  {"method": "OPTIONS", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110', 'Origin': 'example.com', 'User-Agent': 'Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)', 'Connection': 'close', 'Access-Control-Request-Method': 'PATCH'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: http
event_type: request
attacker_ip: Unknown
raw_line:
  <134>1 2026-04-08T03:05:15.829131+00:00 decky-webmail http - request [decnet@55555 method="GET" path="/" remote_addr="192.168.1.5" headers="{'Host': '192.168.1.110'}" body=""]

fields:
  {"method": "GET", "path": "/", "remote_addr": "192.168.1.5", "headers": "{'Host': '192.168.1.110'}", "body": ""}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845325+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="���	�E����Q����P=�<��Ai�
  "]

fields:
  {"src": "192.168.1.5", "cmd": "\ufffd\u0014\u0000\ufffd\ufffd\t\ufffd\u0013\u0000E\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u0000\ufffd\u0000A\u0001\u0000\u0005i\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845403+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="
  ���
  
  #
  (&				"]

fields:
  {"src": "192.168.1.5", "cmd": "\u0000\u001c\u0000\u001a\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000(\u0000&\t\u0004\t\u0005\t\u0006\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845469+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="
  +-3����"]

fields:
  {"src": "192.168.1.5", "cmd": "\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845624+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="�y
  P�RG���fI��NY����ovpЈ�[:�G�����"]

fields:
  {"src": "192.168.1.5", "cmd": "\ufffdy\u000bP\ufffdRG\ufffd\ufffd\b\ufffdfI\ufffd\ufffdN\u0017Y\ufffd\ufffd\ufffd\ufffdovp\u0408\u0018\ufffd[:\ufffdG\ufffd\b\ufffd\ufffd\ufffd\ufffd"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.845689+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="	*�b/O��v�`x\";t$*;l�B\"��*�)��Ȣ�a�q��Ō��A��+��d��Ie�mÚ�{Q��y����24�~��V�`B�!��W\"��/zʿ(��f��	����8jU��Rw5�CR��4����"]

fields:
  {"src": "192.168.1.5", "cmd": "\u0015\t*\ufffdb/O\ufffd\ufffdv\ufffd`x\";t$*;l\ufffdB\"\ufffd\ufffd\u001b*\ufffd)\ufffd\u0013\ufffd\u0002\u0222\ufffda\u0011\ufffdq\ufffd\ufffd\u014c\ufffd\ufffdA\ufffd\ufffd+\ufffd\ufffdd\ufffd\ufffdIe\ufffdm\u00da\ufffd\u001b\u0000\u0019{Q\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd24\u0001\u001b\ufffd~\ufffd\ufffdV\ufffd`B\ufffd!\ufffd\ufffdW\"\ufffd\ufffd/z\u02bf\u0005(\ufffd\ufffdf\ufffd\b\ufffd\t\ufffd\ufffd\ufffd\ufffd8jU\ufffd\u0001\ufffdRw5\ufffdCR\ufffd\ufffd4\ufffd\u001a\ufffd\u0003\ufffd\ufffd"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.846888+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="�AU��`��R/S2��:�hB˦��Wz@%E��v\"c���mcW��Q{�Y_X
  ��mz"]

fields:
  {"src": "192.168.1.5", "cmd": "\ufffdAU\ufffd\ufffd`\ufffd\u0003\u0006\ufffdR\b/S2\ufffd\ufffd:\u0015\ufffdhB\u02e6\u0012\ufffd\ufffdWz@%E\ufffd\u0007\ufffdv\"\u0016c\ufffd\ufffd\ufffdmcW\ufffd\u0017\u0011\ufffdQ\u0002{\ufffdY_X\u000b\ufffd\ufffdmz"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.846967+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="���?ʐ����'*U<w<�#u��"]

fields:
  {"src": "192.168.1.5", "cmd": "\u007f\ufffd\ufffd\ufffd?\u0290\ufffd\ufffd\ufffd\ufffd\u001b'*U<w<\ufffd#u\u0013\ufffd\ufffd\u0012"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847038+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="qT�D��%�ɴ�o�Z�H7Zҹ\\���*g�P~����^���^*�)9�8{jt�(stÓ@b�PWO�$�	�иn�	CqiC�TVlu��cK�Y3�IR5�P�
  �y��y���h�k���iB
  j"]

fields:
  {"src": "192.168.1.5", "cmd": "\u0010\u0018\u0013q\u0016T\ufffd\u0011D\ufffd\ufffd%\ufffd\u0274\u0018\ufffdo\ufffdZ\ufffdH7Z\u04b9\\\ufffd\ufffd\ufffd*g\ufffdP~\u0019\u001a\u001a\ufffd\ufffd\u007f\ufffd\ufffd^\ufffd\ufffd\ufffd^*\ufffd)\u0019\u00049\ufffd8{jt\ufffd(st\u00d3@b\ufffdPWO\ufffd\u007f$\ufffd\t\ufffd\u0438n\ufffd\tCqiC\ufffdTVlu\u0011\ufffd\ufffdcK\b\ufffdY3\ufffdIR5\ufffdP\ufffd\u001e\ufffdy\ufffd\ufffd\u0016y\ufffd\ufffd\b\ufffdh\ufffdk\u0000\ufffd\ufffd\ufffdiB\u001cj"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: imap
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.847363+00:00 decky-webmail imap - command [decnet@55555 src="192.168.1.5" cmd="WSi����iI��
  ,��R�?�g�{MG���Xӛ"]

fields:
  {"src": "192.168.1.5", "cmd": "\u0016\u0003\u0001\u0000W\u0001\u0000\u0000S\u0003\u0003i\ufffd\ufffd\ufffd\u0010\ufffd\u0007iI\ufffd\ufffd\u001e,\ufffd\ufffdR\ufffd?\ufffdg\ufffd{\u0004MG\ufffd\ufffd\ufffd\u0012X\u04db\u0000\u0000"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848356+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="
  +-3�����O����V�j!x[%�D��<��2�9��8M�Q��������es!?�7����j�
  	��6@"]

fields:
  {"src": "192.168.1.5", "cmd": "\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0001\ufffdO\ufffd\ufffd\ufffd\ufffdV\ufffdj!x[%\ufffdD\ufffd\ufffd\u0019<\ufffd\ufffd2\ufffd9\ufffd\ufffd8M\ufffdQ\ufffd\ufffd\u0005\u0018\u0017\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffdes!\u0006?\ufffd7\u0018\u0011\u0013\ufffd\ufffd\ufffd\ufffdj\ufffd\u001c\t\ufffd\ufffd6\u0016\u0017@"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848415+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="�
  �^V�l�
  �t݄�(e=I+'C��)���B��LH.	w_	ԝ��	�rN�
  ��1�Q-v���O�5�Fi.$��C/��ޢ5�~��RИu\"j�d4���[�!�"]

fields:
  {"src": "192.168.1.5", "cmd": "\ufffd\u000b\ufffd^V\ufffdl\ufffd\u001a\u001d\ufffdt\u0744\ufffd(e=I\u0003+'C\ufffd\ufffd)\ufffd\ufffd\ufffdB\ufffd\ufffdLH.\tw_\t\u051d\ufffd\ufffd\t\ufffdrN\ufffd\u000b\ufffd\ufffd\u00191\u0099\u000f\ufffdQ\u0016-v\ufffd\ufffd\ufffdO\ufffd5\ufffdFi.$\ufffd\u0000\ufffdC/\ufffd\u0011\ufffd\u07a25\ufffd\u0015~\ufffd\ufffdR\u0418u\"j\ufffdd4\ufffd\ufffd\ufffd[\ufffd!\ufffd"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848468+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="�E��F;�wn�i���Ta���G�vA��+�:�
  �:�a[��'8"]

fields:
  {"src": "192.168.1.5", "cmd": "\ufffdE\ufffd\ufffdF;\ufffdwn\ufffdi\ufffd\ufffd\ufffdTa\ufffd\ufffd\ufffdG\u0005\ufffdvA\ufffd\ufffd+\ufffd:\ufffd\r\ufffd\u0011:\ufffda[\ufffd\ufffd'8"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848594+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="'t�����>����iw�`�ɇ�eIh�TFf,'���a0'�n���kGc�
  !J3�v�j��2[��PP��:�z���*�����y,��ʞJ�[RX�A��`��!̓���+���kiޔ;,�8*ߡw���z�2�"]

fields:
  {"src": "192.168.1.5", "cmd": "\b't\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\u001f>\ufffd\ufffd\ufffd\ufffdiw\ufffd`\ufffd\u0247\ufffdeIh\ufffdTFf,'\ufffd\ufffd\ufffda0'\ufffdn\ufffd\ufffd\u000e\ufffdkGc\ufffd\u001d!J\u000e3\ufffdv\ufffdj\ufffd\ufffd2[\ufffd\ufffdPP\ufffd\ufffd:\ufffdz\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd\ufffdy,\ufffd\ufffd\u029eJ\ufffd\u001a[RX\ufffdA\ufffd\ufffd`\ufffd\ufffd!\u0313\ufffd\u0005\ufffd\ufffd+\ufffd\ufffd\ufffdk\u0011i\u0794\u0007;\u001b,\ufffd8*\u07e1w\ufffd\ufffd\ufffdz\ufffd\u00152\ufffd"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848649+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="1v�����:�5�VP�t�Ѳ��a[z�z�{B~cm�2Q,x>"]

fields:
  {"src": "192.168.1.5", "cmd": "\u001b1v\ufffd\ufffd\ufffd\u0010\ufffd\ufffd:\ufffd5\ufffdVP\ufffdt\ufffd\u0472\ufffd\ufffda[z\ufffdz\ufffd{B~cm\ufffd2Q,x>\u0016\u0004"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848705+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="-T�'��+$������,-Nѹ$v2���sĳ¶��B��%���Ĺ�9P�'%Q�p�qk�s/���@D8
  I|M�z�ທ疓�l�
  ��;
  �˪���E<�i�q�8?ͺ�?)^q0��J�#���u���F#\\b�|���{�"]

fields:
  {"src": "192.168.1.5", "cmd": "-T\ufffd'\ufffd\u007f\ufffd+$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,-N\u0479$v2\ufffd\ufffd\ufffd\u0016s\u0133\u00b6\ufffd\ufffdB\ufffd\ufffd%\ufffd\ufffd\ufffd\u0139\ufffd9P\ufffd'%Q\u0014\ufffdp\ufffdqk\ufffds/\ufffd\ufffd\ufffd\u001b@D8\fI|M\ufffdz\ufffd\u0e97\u7593\ufffdl\u0004\ufffd\u000b\ufffd\ufffd;\u001c\ufffd\u02ea\ufffd\ufffd\ufffdE<\ufffdi\ufffdq\ufffd8?\u037a\ufffd?)^q0\ufffd\ufffdJ\ufffd#\ufffd\ufffd\ufffd\u000eu\ufffd\ufffd\ufffdF#\\b\ufffd|\ufffd\ufffd\u0006\u0002\ufffd\u001f{\ufffd"}


timestamp: 2026-04-08 03:05:15
decky: decky-webmail
service: pop3
event_type: command
attacker_ip: 192.168.1.5
raw_line:
  <134>1 2026-04-08T03:05:15.848882+00:00 decky-webmail pop3 - command [decnet@55555 src="192.168.1.5" cmd="WSi��뎱sr�`	�B
  @�&��cG|$G�͒
  �/�"]

fields:
  {"src": "192.168.1.5", "cmd": "\u0016\u0003\u0001\u0000W\u0001\u0000\u0000S\u0003\u0003i\ufffd\ufffd\ub3b1sr\ufffd`\t\u007f\ufffdB\u000b@\ufffd&\ufffd\ufffdcG|$G\ufffd\u0352\r\ufffd/\ufffd\u0000\u0000"}


timestamp: 2026-04-08 03:29:47
decky: decky-webmail
service: smtp
event_type: startup
attacker_ip: Unknown
fields: {}
msg: SMTP server starting as decky-webmail
raw_line:
  <134>1 2026-04-08T03:29:47.393300+00:00 decky-webmail smtp - startup - SMTP server starting as decky-webmail


timestamp: 2026-04-08 03:29:47
decky: decky-webmail
service: pop3
event_type: startup
attacker_ip: Unknown
fields: {}
msg: POP3 server starting as decky-webmail
raw_line:
  <134>1 2026-04-08T03:29:47.490394+00:00 decky-webmail pop3 - startup - POP3 server starting as decky-webmail


timestamp: 2026-04-08 03:29:47
decky: decky-webmail
service: imap
event_type: startup
attacker_ip: Unknown
fields: {}
msg: IMAP server starting as decky-webmail
raw_line:
  <134>1 2026-04-08T03:29:47.642795+00:00 decky-webmail imap - startup - IMAP server starting as decky-webmail


timestamp: 2026-04-08 03:29:47
decky: decky-webmail
service: http
event_type: startup
attacker_ip: Unknown
fields: {}
msg: HTTP server starting as decky-webmail
raw_line:
  <134>1 2026-04-08T03:29:47.694889+00:00 decky-webmail http - startup - HTTP server starting as decky-webmail


