This IP belongs to Amazon.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

It persistently tried to exploit weaknesses in the SSH communication encryption.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

It attempted to use the FTP server to store illegal content.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

Attempts to access the server using known malicious IP addresses or domains.

It made multiple requests with identical cookies.

This IP belongs to PepsiCo.

This IP belongs to Apple.

This IP belongs to Nationwide.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

It made multiple requests with the same X-Wap-Profile header.

The IP attempted to use the FTP server to distribute ransomware.

The IP attempted to perform Stack Overflow attacks on the Apache server.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP, accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, comptes et boites mails ! Recu 4ème mail escroc usurpant la Banque NICKEL avec utilisation des serveurs mails mailersend.net et adresse IP 212.11.79.129 gérée par abuse@mailerlite.com Received : from mail129.mailersend.net (mail129.mailersend.net [212.11.79.129]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0113.laposte.net (SMTP Server) with ESMTPS id 4Xwf4l3g92zYcmY for <@laposte.net>; Sat, 23 Nov 2024 18:25:43 +0100 (CET) DKIM-Signature : a=rsa-sha256; bh=XXAoujqoyOXvVsbJFhZ8tD3sg0ABnNVUHfpm+4ijM8U=; c=relaxed/relaxed; d=top25restaurants.com; Recu ce Samedi 23 Novembre 2024 après 18h25 ( mails escrocs toujours envoyés les nuits ou week-ends ) ce 4ème mail ci-dessous usurpant encore la banque NICKEL : venant de la boite mail bidon ou usurpée: MS_BnamXw@top25restaurants.com avec utilisations des serveurs mailersend.net et adresse IP 212.11.79.129 gérée par abuse@mailerlite.com

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.