The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

It attempted to use the FTP server to distribute brute force tools.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

Attempts to access the server using credentials that have been involved in previous security incidents.

The IP made multiple requests using uncommon HTTP methods.

It showed unusual activity in the server's error logs.

This IP belongs to Archer-Daniels-Midland.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

Recu Samedi 28 Decembre 2024 après 03h22 (toujours envoyés les nuits, les week-ends, la veille au soir ) 5 ème mails escrocs usurpant BOURSORAMA Banque venant de l’adresse mail bidon: clean@haylensgarage.com et tilisant des boites mails et adresses IP VIRGIN Media.net ( 86.17.239.211 ) gérée par abuse@ripe.net Received : from 7-207-148-37 (live-34-b2-v4wan-170841-cust466.vm29.cable.virginm.net [86.17.239.211]) by mlpnf0120.laposte.net (SMTP Server) with ESMTP id 4YKmNl3VvSznTVc for <ele.lemoine@laposte.net>; Sat, 28 Dec 2024 03:22:47 +0100 (CET) MIME-Version : 1.0 IP Lookup Details: IP Information - 86.17.239.211 Host name: live-34-b2-v4wan-170841-cust466.vm29.cable.virginm.net Country: United Kingdom Country Code: GB Region: B8 City: Orpington Latitude: 51.3833 Longitude: 0.11670000000001 C’est un 5ème mail d’escroquerie usurpant encore BOURSORAMA Banque ! ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <clean@haylensgarage.com> Received : from mlpnf0120.laposte.net (mlpnf0120.sys.meshcore.net [10.94.128.99]) by mlpnb0108 with LMTPA; Sat, 28 Dec 2024 03:22:47 +0100 X-Cyrus-Session-Id : cyrus-119589-1735352567-1-6681187833167962681 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1735352567; cv=none; b=YQ2YTDApF3hqz07qZA+6IvIVDqNQxYTWcQDtKLV9Kb9Og7RSSOq7J/aE6iFghwo6sSQaHgbIx/Z 9vm/jCxD30lcQWI0ZsCdClsvFkn0g7AyOP0z6SOE3Qv309E3uSgNOhrXwkxwy09h9icUC6C5L0nm 9c7Lu06ZZz6RzNONChURThXz+5kAkQ3IgfcZH3RkfItiSbG+vJsQ2ZUJeHmefRDLc/ygamA8nfVC X+5mMwTFRfuUFTSFlxQ5kI15b1dbrUJM9WnVNlmNgIiTxbzURJVth7NDcB2RSVPLsAaPw74HqydT yHI+ClnEG9GzZPqH3D74MIUsPAhiz1Y+NOYLSNQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1735352567; h=From:To:Date:Subject; bh=NFoGwAZ1xEmFUjd6XXeX/v9e zL5ne5Q+pLXa0PwXdRw=; b=CBP3eXmGQ/mp2+xABd24APjtgHUgSQcyr0AH2jfTELooOviPqRnt tIw+RROwjlycPI/bQqIs3G1PMI7I5IOfrz/bbpnouxeEglZFU1G+XbnJoNzUgAvJruubKtrM7YoU ofx6RYxcXWfUPUoFRrAKP31DnwG7FKrKyM9V/NBJict6ZD0hZV+p1TOsaGFxe0ioXKR3SLCZS2Ji cfnIrb3rK7AJvSm2nZzrM93erfbLz/HXBHsUM4TlxovIT0Wnn8abpPDoPz25O5tluTxRoP3+uGQt GbeZILL4YXPtC9vfHHGN0UscNW193D9h5zyEA1dHtAYCtNvII+TXIOVvrBlT4Q== ARC-Authentication-Results : i=1; laposte.net; spf=none smtp.helo=7-207-148-37 smtp.mailfrom=clean@haylensgarage.com; dkim=none; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=86.17.239.211; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4YKmNl5V9fznTVg","contextId": "0f05853a-0c7b-4783-aab8-508a2c77c743"} X-ppbforward : {"queueID":"4YKmNl5V9fznTVg","server":"mlpnf0120"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0120.laposte.net (SMTP Server) with ESMTP id 4YKmNl5V9fznTVg for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Sat, 28 Dec 2024 03:22:47 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4YKmNl3VvSznTVc","contextId": "dc794ad3-68c0-4859-9aa2-97d0f3b168f8"} X-lpn-mailing : LEGIT X-lpn-spamrating : 55 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=none smtp.mailfrom=clean@haylensgarage.com smtp.helo=7-207-148-37; dkim=none; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=86.17.239.211; bimi=skipped reason="non-pass DMARC" X-lpn-spamcause : OK, (0)(0000)gggruggvucftvghtrhhoucdtuddrgeefuddruddvuddggeehucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucenucfjughrpegghffvfffutgfgsehhsgdttddttdejnecuhfhrohhmpedfufgvrhhvihgtvgcutghlihgvnhhtfdcuoegtlhgvrghnsehhrgihlhgvnhhsghgrrhgrghgvrdgtohhmqeenucggtffrrghtthgvrhhnpeethffftdetteeuteelleegteeghefhvdekkefhueeuteeffeegteejudffieefhfenucffohhmrghinhepthgvtghhvdifihiirghrugdrtghomhenucfkphepkeeirddujedrvdefledrvdduudenucevlhhushhtvghrufhiiigvpedutddtnecurfgrrhgrmhepihhnvghtpeekiedrudejrddvfeelrddvuddupdhhvghlohepjedqvddtjedqudegkedqfeejpdhmrghilhhfrhhomheptghlvggrnheshhgrhihlvghnshhgrghrrghgvgdrtghomhdpnhgspghrtghpthhtohepuddprhgtphhtthhopegvlhgvrdhlvghmohhinhgvsehlrghpohhsthgvrdhnvghtpdhsphhfpehnohhnvgdpughkihhmpehnohhnvgdprhgvvhfkrfeplhhivhgvqdefgedqsgdvqdhvgeifrghnqddujedtkeeguddqtghushhtgeeiiedrvhhmvdelrdgtrggslhgvrdhvihhrghhinhhmrdhnvghtpdhgvghokffrpefiue Received : from 7-207-148-37 (live-34-b2-v4wan-170841-cust466.vm29.cable.virginm.net [86.17.239.211]) by mlpnf0120.laposte.net (SMTP Server) with ESMTP id 4YKmNl3VvSznTVc

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

This IP belongs to Amazon.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

This IP belongs to Oracle.

GET /backup.sql: Attempting to access a backup of your database.

This IP belongs to PythonAnywhere.

This IP belongs to State Farm Insurance.

This IP belongs to Boeing.

Multiple requests with the same DNT (Do Not Track) header.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

This IP belongs to AT&T.

Our records indicate the IP spread multiple executable infector spyware causing system malfunction.

The IP attempted to perform a credential stuffing attack on the POP3 server.