Unusual patterns in the Accept-Language header.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

The IP attempted to perform a distributed denial of service attack on the SSH server.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Recu 10 ème mails usurpant le CREDIT AGRICOLE ! Lundi 06 Janvier 2025 reçu après 02h28 (toujours envoyés les nuits, les week-ends, la veille au soir ) 10ème mail d'escroquerie usurpant le CREDIT AGRICOLE et visant encore les adresses emails à LA POSTE.net en utilisant les boites mails VIRGIN MEDIA et venant de l’adresse mail fausse: cablc@face.com Bonjour Webmasters de SIGNAL SPAM, de LA POSTE.net, et du CREDIT AGRICOLE, et Hello Webmasters of New Scotland Yard, and INTERPOL ( in hidden copies) Ces escroqueries continuent encore en Janvier 2025, et ceci depuis au moins +17 années ( 2007 )(emails tous archivés avec tous leurs codes HTML)! Idem Lundi 04 Septembre 2023 après 09h53 (idem Mercredi 17 Mai 2023 après 17h52, et Mardi 03 Aout 2021 après 17h33, idem Lundi 26 Avril 2021 à 14h56, et Mercredi 20 Janvier 2021 après 12h07, idem Mardi 15 Décembre 2050 à 14h24, et Jeudi 26 Novembre 2020 à 15h04, idem Samedi 28 Novembre 2020 après 20h27, idem Dimanche 06 Décembre 2020 )( souvent les week-ends, et les nuits avant ou après les ouvertures ou fermetures des Bureaux et Administrations en France, méthodes d’escrocs et de faux culs ) j'ai reçu sur ma boite email Laposte.net, ce 10 ème email ci-dessous d’escroquerie Bancaire usurpant ENCORE le CREDIT AGRICOLE et venant cette fois-ci de l'adresse email escroc : cablc@face.com Les adresses IP du serveur ou PC de ces hackers fous sont cette fois-ci: 86.10.14.156 en Grande-Bretagne gérée par abuse@ripe.net et hostmaster@ripe.net et abuse@virginmedia.com Received : from VPS-331963 (sotn-16-b2-v4wan-170608-cust667.vm36.cable.virginm.net [86.10.14.156]) by mlpnf0112.laposte.net (SMTP Server) with ESMTP id 4YRGlS3Jrvz1lt7d for <@laposte.net>; Mon, 6 Jan 2025 02:28:04 +0100 (CET) MIME-Version : 1.0 From : "Agences" cablc@face.com IP Lookup Details: IP Information - 86.10.14.156

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

The IP made multiple requests with the same TE header.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

Unidentified password attempts and login activity were noticed from the specific IP address.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

This IP belongs to TJX.

This IP was detected distributing spyware-infected USB drives to our users.

Repeated connections to the server from unknown or suspicious IP addresses.

It attempted to perform a dictionary attack on the SASL server.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

This IP belongs to DuPont de Nemours.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

This IP belongs to Deutsche Telekom AG.

The IP address was flagged for employing a packet sniffer on our network.

The IP attempted to register as a SIP user with no password.

Repeated attempts to exploit known vulnerabilities in server software.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

The IP made multiple requests with the same DNT header.