The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

It was found that the IP had deployed rogue security software in our system.

Pour Services Sécurité COFIDIS Recu 3ème mail en 1 semaine usurpant COFIDIS: Venant de l’adresse mail bidon: landryduchauvin6@gmail.com Et utilisant les adresses IP GOOGLE : 209.85.221.41 et Received : from TC-Cosmopsarus 154.68.5.127 à ABIDJAN en COTE d’IVOIRE IP Lookup Details: IP Information - 154.68.5.127 Host name: wimax-154.68.5.127.aviso.ci Country: Cote D'Ivoire Country Code: CI Region: 82 City: Abidjan Latitude: 5.3097 Longitude: -4.0127 Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk for <@laposte.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) Received : by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-34ddc9fe497so1913526f8f.3 for <@laposte.net>; Tue, 07 May 2024 08:59:59 -0700 (PDT) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; xxxxxxxxxxxxxxxx CODES HTML des hackers ******************** Return-Path : <landryduchauvin6@gmail.com> Received : from mlpnf0109.laposte.net (mlpnf0109.sys.meshcore.net [10.94.128.88]) by mlpnb0108 with LMTPA; Tue, 07 May 2024 17:59:59 +0200 X-Cyrus-Session-Id : cyrus-213589-1715097599-1-3670923478525053547 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1715097599; cv=none; b=Wra6pr6q2rKxsN+790PhS+rbW9dZ46z7qHMwpHOTUHLJ/acN5QWyCd+CKqXiJEuI89p5fcQQZRs 8G0ZswsQ+iquVO7h+0iBf8XLNSeoPmTCemmTOSsDZ+vFIBlyrPslApevVQBPvApfFR2rqxw+tziD kEZfJjsSBC/6b34AkW7sAZaUvPR2+e2UEQsjwZxk1GEOhcnXCeAmLvEom3r4onSuQzOHAmiEOYjP hdOEELWxzsXDUOUlrEA2ozT19MMbfG8C5kUgFKRP0s57Zz9avHYuCjAtmuOEZc8xBJ5c+5Z2T0h2 Bb7vN0W//5LjzC6eYCRKQfvGoZdHOh/xfFPsFiQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1715097599; h=DKIM-Signature:Date:From:To:Subject; bh=9ah4qL0ow iWE5Q/hjto07kY7vrGVQF5+HoKat+gehWY=; b=sHLVibS8whrZXEnyvzf0Tax3jWICPXWKZX2KN TM4x37lBIJpNK6nAGFfCMXiYdl1TJwO3ZmHFtmz7RLMH+pillyK94ebOKXvHa97MhAnNrMH7mafR DgWS77r6W++OT81W/6qJIyk4zHcm089SDMLruMlbznXoE99hOORsV+67kabL26VZoW+UhrJCFTzU U72MchGGm5prGeXIxv1g8NW8PgUbYRzH4S42lOjS7fXKKqH4FBPXz1JTqEFID6dQl0zoS+a4o+kJ /i+yiAQ9y3EhepQt/8tL2SziWScTlA1673HV6UU/gh50p//epf2wK9am9RW/S/U4GVt/uFfCWa6l g== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wr1-f41.google.com smtp.mailfrom=landryduchauvin6@gmail.com; dkim=pass reason="good signature" header.b=PHi9Km header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf742jzz1xmh","contextId": "93f36f34-827d-4633-b28c-e0aba9bd9588"} X-ppbforward : {"queueID":"4VYjf742jzz1xmh","server":"mlpnf0109"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0109.laposte.net (SMTP Server) with ESMTP id 4VYjf742jzz1xmh for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf738vnz1xmk","contextId": "e816072a-688b-4595-8439-8bad07312644"} X-lpn-mailing : LEGIT X-lpn-spamrating : 40 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=landryduchauvin6@gmail.com smtp.helo=mail-wr1-f41.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=PHi9Km; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (0)(0000)gggruggvucftvghtrhhoucdtuddrgedvledrvddvkedgleefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucenucfjughrpefkffgghffvufgtsehmtderredttdejnecuhfhrohhmpedfvefqhffkqdffkffufdcuoehlrghnughrhiguuhgthhgruhhvihhnieesghhmrghilhdrtghomheqnecuggftrfgrthhtvghrnhepffetgfejhfeiteelveegvdduhedtgeffieffgedtgfevgeejkefgtedtiedvkedvnecuffhomhgrihhnpehsvghnughisghtfedrtghomhenucfkphepvddtledrkeehrddvvddurdeguddpudehgedrieekrdehrdduvdejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvddtledrkeehrddvvddurdeguddphhgvlhhopehmrghilhdqfihruddqfheguddrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomheplhgrnhgurhihughutghhrghuvhhinheisehgmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepvghlvgdrlhgvmhhoihhnvgeslhgrphhoshhtvgdrnhgvthdpshhpfhepphgrshhspdgukhhimhepphgrshhspdgumhgrrhgtpehprghsshdprhgvvhfkrfepmhgrihhlqdifrhduqdhfgedurdhgohhoghhlvgdrtghomhdpghgvohfkrfepfgfu Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk

Recu 3ème mail en 1 semaine usurpant COFIDIS: Venant de l’adresse mail bidon : landryduchauvin6@gmail.com Et utilisant les adresses IP GOOGLE : 209.85.221.41 et Received : from TC-Cosmopsarus 154.68.5.127 Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk for <@laposte.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) Received : by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-34ddc9fe497so1913526f8f.3 for <@laposte.net>; Tue, 07 May 2024 08:59:59 -0700 (PDT) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; xxxxxxxxxxxxxxxx CODES HTML des hackers ******************** Return-Path : <landryduchauvin6@gmail.com> Received : from mlpnf0109.laposte.net (mlpnf0109.sys.meshcore.net [10.94.128.88]) by mlpnb0108 with LMTPA; Tue, 07 May 2024 17:59:59 +0200 X-Cyrus-Session-Id : cyrus-213589-1715097599-1-3670923478525053547 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1715097599; cv=none; b=Wra6pr6q2rKxsN+790PhS+rbW9dZ46z7qHMwpHOTUHLJ/acN5QWyCd+CKqXiJEuI89p5fcQQZRs 8G0ZswsQ+iquVO7h+0iBf8XLNSeoPmTCemmTOSsDZ+vFIBlyrPslApevVQBPvApfFR2rqxw+tziD kEZfJjsSBC/6b34AkW7sAZaUvPR2+e2UEQsjwZxk1GEOhcnXCeAmLvEom3r4onSuQzOHAmiEOYjP hdOEELWxzsXDUOUlrEA2ozT19MMbfG8C5kUgFKRP0s57Zz9avHYuCjAtmuOEZc8xBJ5c+5Z2T0h2 Bb7vN0W//5LjzC6eYCRKQfvGoZdHOh/xfFPsFiQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1715097599; h=DKIM-Signature:Date:From:To:Subject; bh=9ah4qL0ow iWE5Q/hjto07kY7vrGVQF5+HoKat+gehWY=; b=sHLVibS8whrZXEnyvzf0Tax3jWICPXWKZX2KN TM4x37lBIJpNK6nAGFfCMXiYdl1TJwO3ZmHFtmz7RLMH+pillyK94ebOKXvHa97MhAnNrMH7mafR DgWS77r6W++OT81W/6qJIyk4zHcm089SDMLruMlbznXoE99hOORsV+67kabL26VZoW+UhrJCFTzU U72MchGGm5prGeXIxv1g8NW8PgUbYRzH4S42lOjS7fXKKqH4FBPXz1JTqEFID6dQl0zoS+a4o+kJ /i+yiAQ9y3EhepQt/8tL2SziWScTlA1673HV6UU/gh50p//epf2wK9am9RW/S/U4GVt/uFfCWa6l g== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wr1-f41.google.com smtp.mailfrom=landryduchauvin6@gmail.com; dkim=pass reason="good signature" header.b=PHi9Km header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf742jzz1xmh","contextId": "93f36f34-827d-4633-b28c-e0aba9bd9588"} X-ppbforward : {"queueID":"4VYjf742jzz1xmh","server":"mlpnf0109"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0109.laposte.net (SMTP Server) with ESMTP id 4VYjf742jzz1xmh for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf738vnz1xmk","contextId": "e816072a-688b-4595-8439-8bad07312644"} X-lpn-mailing : LEGIT X-lpn-spamrating : 40 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=landryduchauvin6@gmail.com smtp.helo=mail-wr1-f41.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=PHi9Km; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (0)(0000)gggruggvucftvghtrhhoucdtuddrgedvledrvddvkedgleefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucenucfjughrpefkffgghffvufgtsehmtderredttdejnecuhfhrohhmpedfvefqhffkqdffkffufdcuoehlrghnughrhiguuhgthhgruhhvihhnieesghhmrghilhdrtghomheqnecuggftrfgrthhtvghrnhepffetgfejhfeiteelveegvdduhedtgeffieffgedtgfevgeejkefgtedtiedvkedvnecuffhomhgrihhnpehsvghnughisghtfedrtghomhenucfkphepvddtledrkeehrddvvddurdeguddpudehgedrieekrdehrdduvdejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvddtledrkeehrddvvddurdeguddphhgvlhhopehmrghilhdqfihruddqfheguddrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomheplhgrnhgurhihughutghhrghuvhhinheisehgmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepvghlvgdrlhgvmhhoihhnvgeslhgrphhoshhtvgdrnhgvthdpshhpfhepphgrshhspdgukhhimhepphgrshhspdgumhgrrhgtpehprghsshdprhgvvhfkrfepmhgrihhlqdifrhduqdhfgedurdhgohhoghhlvgdrtghomhdpghgvohfkrfepfgfu Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk

The IP attempted to send emails from the Mail server that violate the server's terms of service.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP attempted to delete files from the FTP server.

RECU nouveaux mails d’escroqueries usurpant AMELI.fr en France sur les Boites emails à LAPOSTE.net avec adresse email émettrice bidon : philippe.lea61@miseplacesreativesorients.miseplacesdesaidesfamilliaux.click Bonjour Webmasters de LAPOSTE.net, et SIGNAL SPAM, Signal-Arnaques.com, Arnaques Internet.com, et abuse@laposte.net et alertespam@labanquepostale.fr et abuse@ripe.net et hostmaster@ripe.net et abuse@google.com et abuse@gmail.com et network-abuse@google.com et arin-contact@google.com et fraude-bretic@interieur.gouv.fr Et abuse@microsoft.com et secure@microsoft.com et msndcc@microsoft.com Et IOC@microsoft.com et iphostmaster@microsoft.com Et assurance-maladie@info.ameli.fr et support@info.ameli.fr Et support@phishing-initiative.com et contact@phishing-initiative.com Et presse.cnam@assurance-maladie.fr et comentreprises.drp.cnam@assurance-maladie.fr For your Informations and actions against these hackers using your servers and mails boxes ! Et search-apnic-not-arin@apnic.net et http://www.apnic.net/apnic-info/whois_search2/abuse-and-spamming and F.B.I. Services in U.S.A ( for Google ) in hidden copy for Adress IP in U.S.A ( https://complaint.ic3.gov/default.aspx ) Et celà continue toujours en Mai 2024 et ceci depuis au moins +17 années ( emails tous archivés complets avec tous leurs codes HTML depuis 2007 )( il y a forcément des complicités, du laxisme, des incompétents d’Etats et Services Administratifs chez des fournisseurs d’accès mails, depuis toutes ces +16 années que celà dure ! Ces escrocs ont vraiment la SUPER belle vie pour sévir en France ! Ce Jeudi 09 Mai 2024 après h ( mails escrocs envoyés très souvent les jours fériés, ou les week-ends, très souvent les nuits, avant ou après les horaires des Bureaux et Administrations en France, méthodes de faux-culs et d’escrocs ) j'ai encore reçu sur ma boite email ce même email d’escroqueries aux faux contenus AMELI et venant des adresses mails bidons ou usurpées,volées : @maestro.bounces.google.com Mais vraie adresse mail des hackers: From: philippe.lea61@miseplacesreativesorients.miseplacesdesaidesfamilliaux.click Les adresses IP utilisées par le PC de ce(s) batards de hackers fous, débiles, têtus, butés, et analphabètes ( incapables d’écrire correctement le Français ) et ces mails sont préparés, envoyés en différés qqs heures avant ( ici Mercredi soir 08 Mai à 19h44 pour ne pas être tracés par un logiciel Sniffer sur leurs adresses Mac de cartes réseaux, ou par des commandes Traceroute sur leurs adresses IP en direct ( bandes de poules mouillées, fumiers, trouillards ! ): 209.85.160.199 aux U.S.A Received : from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0118.laposte.net (SMTP Server) with ESMTPS id 4VZbv11H98z12LC8 for <@laposte.net>; Thu, 9 May 2024 04:44:13 +0200 (CEST) Received : by mail-qt1-f199.google.com with SMTP id d75a77b69052e-43df24dbdfdso5447091cf.1 for <@laposte.net>; Wed, 08 May 2024 19:44:13 -0700 (PDT) IP Lookup Details: IP Information - 209.85.160.199 Host name: mail-qt1-f199.google.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 utilisant encore des boites mails GOOGLE.com C'est clairement une tentative de phishing et fraude ( fautes de grammaire multiples ) Ci-dessous cet email d’escroquerie avec ces en-têtes complets : Assurance A̷̤̤MELI [GPX] • Aujourd'hui, à 04:44 (il y a 7 heures) 35Ko • • • S De : Services

It attempted to login to the Mail server with an invalid password.

The IP address attempted to login to the SSH server with an invalid username.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

The IP attempted to send emails from the Postfix server without proper authentication.

The IP sent numerous SIP OPTIONS requests in a short time.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

It attempted to send emails from the Mail server that violate the server's email content policy.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP belongs to TELUS Communications.

The Israel lobby, also known as the Zionist lobby, are individuals and groups seeking to influence the United States government to better serve Israel's interests. The largest pro-Israel lobbying group is Christians United for Israel with over seven million members.<>] The American Israel Public Affairs Committee (AIPAC) is a leading organization within the lobby, speaking on behalf of a coalition of pro-Israel American Jewish groups. see why Israel can kill innocent children with American taxpayer money 1- Because the God of Money of our World is a Jew who supports and lives in Israel. For more details, click on the following link. https://mega.nz/file/FqhzGKbB#bsX4PD-O59HEA0-rynD29xkk47dmddycY5CjZfoDLYg 2- Because https://www.tiktok.com/@thefearlessqueenmel/video/7307640994579680542?lang=en&q=why%20dont%20Americans%20knowl%20what%20you%20have%20seen%20&t=1701880206555 See how innocent children are killed by the most powerful Israeli using American bombs at Al Jazeera Arabic Live at https://www.youtube.com/watch?v=bNyUyrR0PHo if you do not do something such as going on the street and telling your government which is controlled by the Jews to stop killing the Gaza people and stop the Israeli War and send food to the starving people of Gaza. If you can not do it then forward this message with the above two links to at least 4 of your friends and ask them to forward it to 4 of their friends so that the world will know that the new mass murderers are the Jews of the world . It is ironic that the Holocaust servicers (the Jews) are creating a new Holocaust against the Philistines in Gaza. if you do not do this also then you do not have a HART

This IP belongs to State Farm Insurance.

Multiple attempts to access the server using different ports or protocols.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.