This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

This IP belongs to Ford Motor.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

This IP belongs to KT Corporation.

Attempts to use privileged service accounts outside of their normal usage patterns.

The malicious IP was found trying to exploit the IMAP 'unselect' vulnerability.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

The IP attempted to delete directories on the SSH server.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

Unexpected changes in the server configuration or installed software.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, comptes et boites mails ! FOR YOUR INFORMATIONS and ACTIONS against these HACKERS USING your servers IP and accounts and mails boxes ! Bonjour Webmasters de BNP Paribas, Signal Spam, La Poste.net, et DigitalOcean, Et celà continue encore en Aout 2024 ( 4ème mails archivés complets avec tous leurs codes HTML depuis 2007 ) ! Ce Mardi 27 Aout 2024 après 01h55 ( toujours les nuits, ou week-ends, avant ou après les horaires des Bureaux et Administrations en France, méthodes de faux-culs et d’escrocs ) j'ai reçu sur ma boite email ce 4ème email ci-dessous de Phishing Bancaire avec faux contenu banque BNP Paribas et venant de l'adresse email : From : Gestion BNPparibas Client <infoiux@gestionhmyt.briamjsu.uk> Les adresses IP du PC ou du smartphone de ce(s) hacker(s) fou(s) en cause sont : 64.227.41.216 Gérée par: abuse@digitalocean.com et noc@digitalocean.com Received : from gestionhmyt.briamjsu.uk (unknown [64.227.41.216]) by mlpnf0114.laposte.net (SMTP Server) with ESMTP id 4Wt6x24x2YzjWxT for <@laposte.net>; Tue, 27 Aug 2024 01:55:02 +0200 (CEST) Received : from cne1retprdsrs01.cnam-ens.gestionhmyt.briamjsu.uk ([183.13.13:CE81F42AC0]) by cmsmtp with ESMTP id CE81F42AC0 ; Mon, 26 Aug 2024 23:54:59 +0000 DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/simple; d=gestionhmyt.briamjsu.uk; s=default; t=1724716499; bh=qySezyjZb1SZdEpi3Ag4aE09slDCV3oPUnj5CIzyc9E=; IP Lookup Details: IP Information - 64.227.41.216 Host name: 64.227.41.216 Country: United States Country Code: US Region: FL City: Jacksonville Latitude: 30.1438 Longitude: -81.5401 utilisant encore une adresse IP de serveurs aux USA : Et utilisant aussi les boites emails et serveurs de la Société UK : gestionhmyt.briamjsu.uk : C'est visiblement et clairement une tentative de phishing et fraude ! Je ne suis pas prêt d’avoir un compte à la BNP, ni de gérer mes comptes par Internet ! Ci-dessous cet email d’escroquerie avec ces en-têtes complets : Les fraudeurs vous ciblent, protégez vous avec 2FA . • Aujourd'hui, à 01:55 (il y a 7 heures) 12Ko • • • GC De : Gestion BNPparibas Client

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

It attempted to delete emails from the IMAP server without authorization.

Participated in malicious pranks by altering messages sent through the server.

This IP belongs to DuPont de Nemours.

The IP attempted to gain unauthorized access to the Apache server.

This IP belongs to IBM.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

This IP belongs to Phillips 66.