It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour Services Sécurité GOOGLE. Recu Lundi 20 Janvier 2025 après 21h12 (toujours les nuits, ou les week-ends) mail escroc ( pseudo gain Loterie ) venant de l’adresse mail escroc, usurpée: tif24215@tiffincityschools.org Et venant de l’adresse IP mails: 209.85.219.171 gérée par network-abuse@google.com Received : from mail-yb1-f171.google.com (mail-yb1-f171.google.com [209.85.219.171]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0116.laposte.net (SMTP Server) with ESMTPS id 4YcM2P67Y3z1GBwC for <@laposte.net>; Mon, 20 Jan 2025 21:12:29 +0100 (CET) Received : by mail-yb1-f171.google.com with SMTP id 3f1490d57ef6-e3c9ec344efso7051360276.2 for <@laposte.net>; Mon, 20 Jan 2025 12:12:29 -0800 (PST) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; ************************* Codes HTML des hackers ********************* Return-Path : <tif24215@tiffincityschools.org> Received : from mlpnf0116.laposte.net (mlpnf0116.sys.meshcore.net [10.94.128.95]) by mlpnb0108 with LMTPA; Mon, 20 Jan 2025 21:12:30 +0100

The IP attempted to execute unauthorized commands on the SSH server.

This IP belongs to Gilead Sciences.

The IP attempted to use the FTP server to distribute network mapping tools.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

This IP belongs to 3M.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

This IP belongs to Zayo Bandwidth.

This IP belongs to Cisco Systems.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

It attempted to take advantage of misconfigurations in the Apache server.

This IP belongs to Cardinal Health.

The IP attempted to download emails from the IMAP server without authorization.

This IP belongs to Pinterest.

This IP belongs to World Fuel Services.

Unusual patterns in referrer URLs.

This IP belongs to Sysco.

It attempted to exploit known vulnerabilities in the FTP protocol.

Multiple requests with the same TE (Transfer Encoding) header.

It sent VOIP requests to non-existent extensions.

This IP belongs to Cloudfare.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.