It attempted to use the SIP server to perform a reflection DDoS attack.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

It launched a botnet to infiltrate our Apache-DDoS service.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

The IP under scrutiny has been associated with multiple modem hijackers.

Frequent password reset requests.

FOR YOUR INFORMATIONS and ACTIONS against these HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, comptes et boites mails ! Recu mail escroc aux faux loyers impayés et titré: Loyer Mardi 10 Septembre 2024 après 18h10 (toujours avant ou après les horaires ouvrés des Bureaux et Administrations en France, ou les nuits, méthodes d’escrocs ) j’ai reçu ce mail escroc ci-dessous venant l’adresse mail bidon ou usurpée: ds345187@schools.mk Mais vraie adresse mail gérée par GMAIL, pour répondre aux hackers : Reply-To: gestimmoservicereglement@gmail.com Et utilisant les adresses IP: 40.107.241.111 Received : from EUR02-VI1-obe.outbound.protection.outlook.com (mail-vi1eur02on2111.outbound.protection.outlook.com [40.107.241.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0107.laposte.net (SMTP Server) with ESMTPS id 4X37wV54Rhz1qqm7 for <@laposte.net>; Tue, 10 Sep 2024 18:10:50 +0200 (CEST) ARC-Seal : i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; IP Lookup Details: IP Information - 40.107.241.111 Host name: mail-vi1eur02on2111.outbound.protection.outlook.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 ********************** Code HTML des hackers ************************ Return-Path : <ds345187@schools.mk> Received : from mlpnf0107.laposte.net (mlpnf0107.sys.meshcore.net [10.94.128.86]) by mlpnb0108 with LMTPA; Tue, 10 Sep 2024 18:10:59 +0200 X-Cyrus-Session-Id : cyrus-230724-1725984659-1-12540717240667307613 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=2; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1725984657; cv=pass; b=AfHraoZfRffqQRzeTgsMDhx8FB4+iAfkr+RISh41mdDOlefKm6Ye3ma7QjlECy+LKho5FBEBQtW ckE3pWK65w/kKgKlqEzbgxsoddl6+mcLkvRmgVxZjVI77AweFb1z0TARJPo74CznjFURD8ysrvBb iugPzy47188KIKYu602JQRrd7hS08SzlONygMAebsYrY1SC4tDcgbPL2M4k1ypG1artuuyjH2yLY vDuMK7qiK4UJwWGhajAMkUq/h3nq59MA9uLKDnTaG/xU1akAE6/TT9STPibkhgo/z/y7XtCXNLj6 8rbW3ylV5KRXKp5H+OjVgj2/lJnzqroK4SVTnXg== ARC-Message-Signature : i=2; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1725984657; h=DKIM-Signature:From:To:Reply-To:Date:Subject; bh= YiHVTZCJoXIsgANyhejFfVK3V+lbczGtYQ0ngPT5lF0=; b=oOjtbfjMa2HJ/rNbihQG2U2wPaLU aVrKeQOSmvEqZCU1JKSB4yLVYVOIBiWjUkacOLh/ngk+kQPj10+4uqVWh5hpdzdY8ZsSF1aSGplB GiL95YOKky36tGTRAYDPi06tiPB9xzJnhhXFddhavA+QJfmH2WVP+zoPhogFF4yHyiVfRtT0KK6t fuCdar2QkW7XAJDBSeVm1N8NSngYpzj7gc3eRrOdPEowB49/8LOm5cFCcymrc+7ETLjdTOY1803R DNWJ43xwsgGdeAyCOqVmJtXU2TktbUOhsTC1iAd0YhqGQ9ivfiPefkwsTbFlZixrSQxqL2ai2zOS WeHPRL/NqQ== ARC-Authentication-Results : i=2; laposte.net; spf=pass smtp.helo=EUR02-VI1-obe.outbound.protection.outlook.com smtp.mailfrom=ds345187@schools.mk; dkim=pass reason="good signature" header.b=FYu2S4 header.d=schools.mk header.s=selector1; dmarc=none reason="No policy found"; arc=pass header.oldest-pass=0 smtp.remote-ip=40.107.241.111; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4X37wd3wXZz1qqmd","contextId": "45b04fd3-94d2-4f81-9913-c563c9c2c618"} X-ppbforward : {"queueID":"4X37wd3wXZz1qqmd","server":"mlpnf0107"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0107.laposte.net (SMTP Server) with ESMTP id 4X37wd3wXZz1qqmd for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 10 Sep 2024 18:10:57 +0200 (CEST) X-mail-filterd : {"version":"1.8.0","queueID":"4X37wV54Rhz1qqm7","contextId": "864d0681-25e1-476d-a1bf-a118bf502ba6"} X-lpn-mailing : LEGIT X-lpn-spamrating : 42 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=ds345187@schools.mk smtp.helo=EUR02-VI1-obe.outbound.protection.outlook.com; dkim=pass reason="good signature" header.d=schools.mk header.s=selector1 header.b=FYu2S4; dmarc=none reason="No policy found"; arc=pass smtp.remote-ip=40.107.241.111 header.oldest-pass=0; bimi=skipped reason="non-pass DMARC" X-lpn-spamcause : OK, (10)(0000)gggruggvucftvghtrhhoucdtuddrgeeftddrudeiledgkeekucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucgouegrugfjthhmlhdqqdfuuhhsphgvtghtnfhofidqofhishhsnfhotggrthgvugfvrghgqdeuucdluddtmdenucfjughrpefhvfhrfffutgfgkfggsehhsgdttddttdejnecuhfhrohhmpedfhfgrtghtuhhrrghtihhonhcutghomhhpthgrsghlvgcuihhmmhhofdcuoegushefgeehudekjeesshgthhhoohhlshdrmhhkqeenucggtffrrghtthgvrhhnpefgjeejleekteeigedtleejgfegtdeugfejtdduhffffeehudejtddvfeehffekveenucffohhmrghinheprghvrghsthdrtghomhenucfkphepgedtrddutdejrddvgedurdduuddupddviedtfeemuddtrgeimedvtdgsmeeiudelmeemudejnecuvehluhhsthgvrhfuihiivgepudefnecurfgrrhgrmhepihhnvghtpeegtddruddtjedrvdeguddrudduuddphhgvlhhopefgfgfttddvqdggkfduqdhosggvrdhouhhtsghouhhnugdrphhrohhtvggtthhiohhnrdhouhhtlhhoohhkrdgtohhmpdhmrghilhhfrhhomhepughsfeeghedukeejsehstghhohholhhsrdhmkhdpnhgspghrtghpthhtohepuddprhgtphhtthhopegvlhgvrdhlvghmohhinhgvsehlrghpohhsthgvrdhnvghtpdhsphhfpehprghsshd pughkihhmpehprghsshdpughmrghrtgepnhhonhgvpdhrvghvkffrpehmrghilhdqvhhiudgvuhhrtddvohhnvdduuddurdhouhhtsghouhhnugdrphhrohhtvggtthhiohhnrdhouhhtlhhoohhkrdgtohhmpdhgvghokffrpeetvf Received : from EUR02-VI1-obe.outbound.protection.outlook.com (mail-vi1eur02on2111.outbound.protection.outlook.com [40.107.241.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0107.laposte.net (SMTP Server) with ESMTPS id 4X37wV54Rhz1qqm7

The IP tried to perform a cross-site request forgery attack on the IMAP service.

The IP attempted to use the FTP server to distribute spam.

This IP belongs to Amazon Web Services.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

GET /login.action: Trying to find a Struts2 application to exploit.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

Damaging activities showing connections to rootkit attacks were associated with this IP.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

Unidentified password attempts and login activity were noticed from the specific IP address.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

It was found initiating attack vectors to exploit SSH agent forwarding.

Multiple account lockouts in a short period of time.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.