It attempted to use the IMAP server to relay spam.

FOR YOUR INFORMATIONS and ACTIONS against these HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, comptes et boites mails ! Recu Mardi 13 Aout 2024 après 20h20 (envoyés toujours les nuits, ou les week-ends ) 8ème même mail escroc usurpant encore SNCF CONNECT et venant de l’adresse mail bidon des hackers: From: : info@mail.sncfconnect.com Et adresse IP 149.72.195.11 gérée par Utilisant ( encore ) des serveurs mails sendgrid.net Et venant du PC : From: DESKTOPPSR9NL9 Received : from wrqvcphb.outbound-mail.sendgrid.net (wrqvcphb.outbound-mail.sendgrid.net [149.72.195.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0103.laposte.net (SMTP Server) with ESMTPS id 4Wk07739Yyz7t7Z for <@laposte.net>; Tue, 13 Aug 2024 20:20:35 +0200 (CEST) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.net; h=from:subject:mime-version:content-type:to:cc:content-type:from: subject:to; s=smtpapi; bh=+ShwIAT6SaaA3DxeLXjQvWdkXjWgExxj+9kL8mdClTI=; b=zWcgBe4qBJ5c3PvaOp/dAZL7xbJShdo15RfSEseK3YihjP66smaxP3XVuVqKtMjpYFP6 JYm1PIEzDV0aTGCdKAU4dMopADo3K0BgeiNmmOogc+2pLv2MbvYRWFavCey+VPJtwT32a4 bQ1SDS6HeJMQkHZEW1Dn3mIpNf1F1u0J4= Received : by recvd-6c656b9ddd-sphbd with SMTP id recvd-6c656b9ddd-sphbd-1-66BBA3F1-31 2024-08-13 18:20:33.26099342 +0000 UTC m=+1285207.520485450 Received : from DESKTOPPSR9NL9 (unknown) by geopod-ismtpd-4 (SG) with ESMTP id 96XXqrlLR9yFbsS_1Q4OVA Adresse IP encore gérée par: t+arin@sendgrid.com et netops+arin@sendgrid.com et abuse@sendgrid.com

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

It made multiple requests with identical Accept-Charset headers.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

This IP belongs to Morgan Stanley.

This IP belongs to AT&T.

This IP belongs to Valero Energy.

This IP belongs to Nintendo.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

GET /admin: Looking for an unprotected admin page.

Our team flagged this IP for injecting harmful ActiveX codes.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

This IP belongs to Archer-Daniels-Midland.

Participated in the notorious Water Torture attack to overload our DNS servers.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.