This IP was caught circulating email worms, camouflaged as legitimate mails.

Recu Vendredi 10 Mai 2024 après 05h48 (toujours les nuits, ou les week-ends) mail escroc usurpant la FRANCAISE des JEUX et venant de l’adresse mail escroc des hackers: rebecca.roineau@culture.gouv.fr venant de l’adresse Originating-IP: 143.126.211.17 gérée par : abuse@ripe.net et hostmaster@ripe.net Received : from lares.culture.fr (lares.culture.fr [143.126.211.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0111.laposte.net (SMTP Server) with ESMTPS id 4VbFGH2d3JzTgCF; Fri, 10 May 2024 05:48:07 +0200 (CEST) Received : from pasteur03.culture.fr (pasteur03.culture.fr [143.126.201.124]) by lares.culture.fr with ESMTP id 44A3m16O024267-44A3m16P024267; Fri, 10 May 2024 05:48:01 +0200 Received : from msg-p0-exc511.atm.ad.culture.fr (heckel.culture.fr [143.126.201.38]) by pasteur03.culture.fr (8.17.1.19/8.17.1.19) with ESMTPS id 44A3ljMZ010770 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Fri, 10 May 2024 05:47:45 +0200 Received : from msg-p0-exc514.atm.ad.culture.fr (143.126.225.37) by msg-p0-exc511.atm.ad.culture.fr (143.126.225.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Fri, 10 May 2024 05:47:41 +0200 Received : from msg-p0-exc514.atm.ad.culture.fr ([fe80::61d7:3fd0:643b:29c5]) by msg-p0-exc514.atm.ad.culture.fr ([fe80::61d7:3fd0:643b:29c5%5]) with mapi id 15.01.2507.035; Fri, 10 May 2024 05:47:40 +0200 From : ROINEAU Rébecca <rebecca.roineau@culture.gouv.fr> x-originating-ip : [143.126.211.17] et venant de l’adresse IP 143.126.211.17 gérée par : abuse@ripe.net et hostmaster@ripe.net

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

Recu Vendredi 10 Mai 2024 après 04h11 (envoyés toujours les nuits, ou les week-ends ) 5ème même mail escroc usurpant ENCORE SNCF Connect et venant de l’adresse mail bidon des hackers: bolando@xlrhgsesncf.lpmnbi.fr Et adresse IP 134.122.68.16 Received : from xlrhgsesncf.lpmnbi.fr (xlrhgsesncf.lpmnbi.fr [134.122.68.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0119.laposte.net (SMTP Server) with ESMTPS id 4VbC6R3xlxzKm4J; Fri, 10 May 2024 04:11:11 +0200 (CEST) Date : Fri, 10 May 2024 04:10:53 +0200 Authentication-Results : xlrhgsesncf.lpmnbi.fr; dkim=pass (2048-bit key; unprotected) header.d=xlrhgsesncf.lpmnbi.fr header.i=@xlrhgsesncf.lpmnbi.fr header.a=rsa-sha256 header.s=default header.b=S9Lu2A0v; dkim-atps=neutral Utilisant des serveurs mails lpmnbi.fr et venant de l’adresse IP 134.122.68.16 aux U.S.A adresse IP gérée par: noc@digitalocean.com et abuse@digitalocean.com

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

The IP address was flagged for employing a packet sniffer on our network.

This IP belongs to Berkshire Hathaway.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

Multiple requests with the same X-Requested-With header.

This IP belongs to Shopify.

This IP directed malicious network traffic to our servers with the intent to crash them.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

It attempted to use the FTP server to distribute terrorist propaganda.

It attempted to perform a man-in-the-middle attack on the SSH server.

The IP address attempted to login to the FTP server with an invalid username.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

It was found that the IP had deployed rogue security software in our system.

Pour Services Sécurité COFIDIS Recu 3ème mail en 1 semaine usurpant COFIDIS: Venant de l’adresse mail bidon: landryduchauvin6@gmail.com Et utilisant les adresses IP GOOGLE : 209.85.221.41 et Received : from TC-Cosmopsarus 154.68.5.127 à ABIDJAN en COTE d’IVOIRE IP Lookup Details: IP Information - 154.68.5.127 Host name: wimax-154.68.5.127.aviso.ci Country: Cote D'Ivoire Country Code: CI Region: 82 City: Abidjan Latitude: 5.3097 Longitude: -4.0127 Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk for <@laposte.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) Received : by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-34ddc9fe497so1913526f8f.3 for <@laposte.net>; Tue, 07 May 2024 08:59:59 -0700 (PDT) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; xxxxxxxxxxxxxxxx CODES HTML des hackers ******************** Return-Path : <landryduchauvin6@gmail.com> Received : from mlpnf0109.laposte.net (mlpnf0109.sys.meshcore.net [10.94.128.88]) by mlpnb0108 with LMTPA; Tue, 07 May 2024 17:59:59 +0200 X-Cyrus-Session-Id : cyrus-213589-1715097599-1-3670923478525053547 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1715097599; cv=none; b=Wra6pr6q2rKxsN+790PhS+rbW9dZ46z7qHMwpHOTUHLJ/acN5QWyCd+CKqXiJEuI89p5fcQQZRs 8G0ZswsQ+iquVO7h+0iBf8XLNSeoPmTCemmTOSsDZ+vFIBlyrPslApevVQBPvApfFR2rqxw+tziD kEZfJjsSBC/6b34AkW7sAZaUvPR2+e2UEQsjwZxk1GEOhcnXCeAmLvEom3r4onSuQzOHAmiEOYjP hdOEELWxzsXDUOUlrEA2ozT19MMbfG8C5kUgFKRP0s57Zz9avHYuCjAtmuOEZc8xBJ5c+5Z2T0h2 Bb7vN0W//5LjzC6eYCRKQfvGoZdHOh/xfFPsFiQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1715097599; h=DKIM-Signature:Date:From:To:Subject; bh=9ah4qL0ow iWE5Q/hjto07kY7vrGVQF5+HoKat+gehWY=; b=sHLVibS8whrZXEnyvzf0Tax3jWICPXWKZX2KN TM4x37lBIJpNK6nAGFfCMXiYdl1TJwO3ZmHFtmz7RLMH+pillyK94ebOKXvHa97MhAnNrMH7mafR DgWS77r6W++OT81W/6qJIyk4zHcm089SDMLruMlbznXoE99hOORsV+67kabL26VZoW+UhrJCFTzU U72MchGGm5prGeXIxv1g8NW8PgUbYRzH4S42lOjS7fXKKqH4FBPXz1JTqEFID6dQl0zoS+a4o+kJ /i+yiAQ9y3EhepQt/8tL2SziWScTlA1673HV6UU/gh50p//epf2wK9am9RW/S/U4GVt/uFfCWa6l g== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wr1-f41.google.com smtp.mailfrom=landryduchauvin6@gmail.com; dkim=pass reason="good signature" header.b=PHi9Km header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf742jzz1xmh","contextId": "93f36f34-827d-4633-b28c-e0aba9bd9588"} X-ppbforward : {"queueID":"4VYjf742jzz1xmh","server":"mlpnf0109"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0109.laposte.net (SMTP Server) with ESMTP id 4VYjf742jzz1xmh for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf738vnz1xmk","contextId": "e816072a-688b-4595-8439-8bad07312644"} X-lpn-mailing : LEGIT X-lpn-spamrating : 40 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=landryduchauvin6@gmail.com smtp.helo=mail-wr1-f41.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=PHi9Km; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (0)(0000)gggruggvucftvghtrhhoucdtuddrgedvledrvddvkedgleefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucenucfjughrpefkffgghffvufgtsehmtderredttdejnecuhfhrohhmpedfvefqhffkqdffkffufdcuoehlrghnughrhiguuhgthhgruhhvihhnieesghhmrghilhdrtghomheqnecuggftrfgrthhtvghrnhepffetgfejhfeiteelveegvdduhedtgeffieffgedtgfevgeejkefgtedtiedvkedvnecuffhomhgrihhnpehsvghnughisghtfedrtghomhenucfkphepvddtledrkeehrddvvddurdeguddpudehgedrieekrdehrdduvdejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvddtledrkeehrddvvddurdeguddphhgvlhhopehmrghilhdqfihruddqfheguddrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomheplhgrnhgurhihughutghhrghuvhhinheisehgmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepvghlvgdrlhgvmhhoihhnvgeslhgrphhoshhtvgdrnhgvthdpshhpfhepphgrshhspdgukhhimhepphgrshhspdgumhgrrhgtpehprghsshdprhgvvhfkrfepmhgrihhlqdifrhduqdhfgedurdhgohhoghhlvgdrtghomhdpghgvohfkrfepfgfu Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk