The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

Repeated failed attempts to perform actions that require higher privileges.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

Participated in a botnet attack to overwhelm our server’s resources.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

Participated in the notorious Water Torture attack to overload our DNS servers.

The IP made multiple requests with the same Proxy-Connection header.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

This IP belongs to Home Depot.

Our data indicates this IP has performed data breaches by launching phishing attacks.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

FOR YOUR INFORMATIONS and ACTIONS against these bastards hackers using your servers IP and mails boxes Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, comptes et boites mails ! Recu Jeudi 01 Aout 2024 après 18h57 (envoyés toujours les nuits, avant ou après les horaires ouvrés des Bureaux et Administrations en FRANCE ) mail escroc usurpant la SCP SAUNIER d’Huissiers et venant de l’adresse mail bidon ou usurpée des hackers: From: bill@nerovana.com Et adresse IP 104.244.126.255 gérée par abuse@inmotionhosting.com Et adresse IP: Received : from [196.127.64.216] Utilisant des serveurs mails inmotionhosting.com Received : from ded3121.inmotionhosting.com (ded3121.inmotionhosting.com [104.244.126.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) Received : from [196.127.64.216] ************** Codes HTML des hackers **************** Return-Path : <bill@nerovana.com> Received : from mlpnf0108.laposte.net (mlpnf0108.sys.meshcore.net [10.94.128.87]) by mlpnb0108 with LMTPA; Thu, 01 Aug 2024 18:57:35 +0200 X-Cyrus-Session-Id : cyrus-135792-1722531455-1-8475419798817401367 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1722531455; cv=none;

Recu Jeudi 01 Aout 2024 après 18h57 (envoyés toujours les nuits, avant ou après les horaires ouvrés des Bureaux et Administrations en FRANCE ) mail escroc usurpant la SCP SAUNIER d’Huissiers et venant de l’adresse mail bidon ou usurpée des hackers: From: bill@nerovana.com Et adresse IP 104.244.126.255 gérée par abuse@inmotionhosting.com Et adresse IP: Received : from [196.127.64.216] Utilisant des serveurs mails inmotionhosting.com Received : from ded3121.inmotionhosting.com (ded3121.inmotionhosting.com [104.244.126.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) Received : from [196.127.64.216] ************** Codes HTML des hackers **************** Return-Path : <bill@nerovana.com> Received : from mlpnf0108.laposte.net (mlpnf0108.sys.meshcore.net [10.94.128.87]) by mlpnb0108 with LMTPA; Thu, 01 Aug 2024 18:57:35 +0200

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

This IP belongs to Tumblr.

This IP belongs to Morgan Stanley.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

Unusual activity in the server's error logs.