Reçu 11 ème mails usurpant la SOCIETE GENERALE avec serveurs IP Virgin Medias et boite mails usurpées SHOPMAES.com Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Bonjour Webmasters de Signal Spam, de la Société Générale, et Société Virgin Media et SHOPMAES.com usurpées Et celà continue toujours Mi-Décembre 2024, après Mars 2017 ! comme toute les années 2016, 2015, 2014, 2013 et 2012 ! Ce Lundi 16 Decembre 2024 après 05h29 (envoyés toujours les nuits, ou tôt les matinées, avant ou après les ouvertures de Bureaux et Administrations en France, méthodes d’escrocs et de faux-culs ) j'ai reçu sur ma boite mails ce 11 ème mail ci-dessous d’escroquerie Bancaire avec faux contenu SOCIETE GENERALE et venant de l'adresse email bidon ou usurpée: actu@shopmaes.com L’adresse IP du serveur de ces hackers fous est: 86.2.49.156 gérée par abuse@virginmedia.com Received : from WIN-H3JMLD696JD (cpc94370-ward12-2-0-cust411.10-2.cable.virginm.net [86.2.49.156]) by mlpnf0120.laposte.net (SMTP Server) with ESMTP id 4YBRm00Sq0znTV7 for <ele.lemoine@laposte.net>; Mon, 16 Dec 2024 05:29:03 +0100 (CET) MIME-Version : 1.0 utilisant une adresse mail de messagerie des serveurs IP de la Société C'est visiblement et clairement une tentative d’escroquerie ! Je ne suis pas prêt d’avoir un Compte à la SOCIETE GENERALE, ni de gérer mes comptes par Internet ! Ci-dessous cet email de phishing avec ces en-têtes complets : ( siège@societegenerale.fr ) • Aujourd'hui, à 05:29 (il y a 6 heures) 4Ko • • • SC De : Services client • A : Moi • Bonjour, Vous avez reçu un message sur votre messagerie. Vous pouvez le consulter en : Cliquez ici Merci de ne pas répondre à ce message, vous n'aurez pas de réponse. Nous vous prions de croire, Cher Client, en notre sincère considération. *********************** Ci-dessous CODES HTML des hackers **************************************** Return-Path : <actu@shopmaes.com> Received : from mlpnf0120.laposte.net (mlpnf0120.sys.meshcore.net [10.94.128.99]) by mlpnb0108 with LMTPA; Mon, 16 Dec 2024 05:29:04 +0100 X-Cyrus-Session-Id : cyrus-116623-1734323344-1-1908823602677057456 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1734323344; cv=none; b=MTl3Y73ku5sTlZlCenQYt2njhFpVTN/F/gKNM/r9dqsqJ2k2TEUa6ALpDHqcEuzcKdgymKhHBtc jSVckN7h3YgMnU+pKF7ycmXc0XxZowuzoYRPMJjFZ41OWcGCUBX2cLGhUSHKvMAgpHoLP8fEO+P0 VixIgNuLOo7utWNLddcw1aSc8o3zBH7pIs+3eYWlRcQ8amKCMew6jyaq9rICkbbU/q3fVVv3cHb2 laeoSjQZ3qXyofo9XCrIIWqzWgSN/h1F36oe4RAtP4FLeSyWRXWEaCQXZ+oyIhmigxAsVEqR+qMM LgGkJo/prvygbnSHkkCRAX5KjFX0CaimFJbgZzQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1734323344; h=From:To:Date:Subject; bh=vqaTIiO1UN48rv6FcoWpwkr6 uMo7HIMozp1Fy9m1RNs=; b=gaEWmRxDmesES1cVI4m/W14OM+/fJ0Z9nnftq6rXGEiB7mgk65Zc HQuJnCHjW3b3mjntFNWdKL3QCylzwV2w0pMLMXIu7xo3b8XAA5AwcGGt1Cyo5k9sfZr7MJOFGUAx wCi9kA27KduwUAh1gJdYqqFNEqFx0FND2hJ9IlixBsXFxx8t4Y3kkMaeYhOF95376b+vEfh6dak/ snpb57edbuk4ZbaGr46n5ZQbHoSir692/4ASK4U8fPnAN1YFsIy6DVdNf/t9rI1ohsFdygW7R9oI vXywU6dRoEeV+kB0RVNhdypFA4l7AfaXwLt8JzDiomDJHcComvmOSQFmz+r9Ow== ARC-Authentication-Results : i=1; laposte.net; spf=none smtp.helo=WIN-H3JMLD696JD smtp.mailfrom=actu@shopmaes.com; dkim=none; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=86.2.49.156; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4YBRm06cSZznTV5","contextId": "c8665d3a-f79c-4af6-9c83-b4a1a663e10e"} X-ppbforward : {"queueID":"4YBRm06cSZznTV5","server":"mlpnf0120"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0120.laposte.net (SMTP Server) with ESMTP id 4YBRm06cSZznTV5 for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Mon, 16 Dec 2024 05:29:04 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4YBRm00Sq0znTV7","contextId": "cf840d21-2e39-4ddb-85fe-57adb0dfd771"} X-lpn-mailing : LEGIT X-lpn-spamrating : 55 X-lpn-spamlevel : not-spam

This IP belongs to Johnson & Johnson.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Damaging activities showing connections to rootkit attacks were associated with this IP.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

This IP belongs to Nintendo.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

This IP belongs to Apple.

The IP attempted to use the SSH server to relay data to other systems.

This particular IP tried to perform an unauthorized system configuration change.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

The IP attempted to perform Session Hijacking attacks on the Apache server.

It attempted to perform a man-in-the-middle attack on the SSH server.

The IP attempted to perform a SNMP amplification attack on the SSH server.

Multiple requests with the same If-Match header.

It launched a botnet to infiltrate our Apache-DDoS service.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

It attempted to perform a Steam protocol amplification attack on the SSH server.

This IP belongs to MTN.

This IP executed mass-probing of various ports to seek vulnerabilities.

The IP was caught trying to overload the server through a Distributed Denial of Service attack.