It made multiple requests with the same X-Requested-With header.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

The IP attempted to perform a replay attack on the IMAP server.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour Services Sécurité GOOGLE. Recu Lundi 20 Janvier 2025 après 21h12 (toujours les nuits, ou les week-ends) mail escroc ( pseudo gain Loterie ) venant de l’adresse mail escroc, usurpée: tif24215@tiffincityschools.org Et venant de l’adresse IP mails: 209.85.219.171 gérée par network-abuse@google.com Received : from mail-yb1-f171.google.com (mail-yb1-f171.google.com [209.85.219.171]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0116.laposte.net (SMTP Server) with ESMTPS id 4YcM2P67Y3z1GBwC for <@laposte.net>; Mon, 20 Jan 2025 21:12:29 +0100 (CET) Received : by mail-yb1-f171.google.com with SMTP id 3f1490d57ef6-e3c9ec344efso7051360276.2 for <@laposte.net>; Mon, 20 Jan 2025 12:12:29 -0800 (PST) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; ************************* Codes HTML des hackers ********************* Return-Path : <tif24215@tiffincityschools.org> Received : from mlpnf0116.laposte.net (mlpnf0116.sys.meshcore.net [10.94.128.95]) by mlpnb0108 with LMTPA; Mon, 20 Jan 2025 21:12:30 +0100

This IP belongs to Exelon.

This IP has been flagged for attempting to escalate privileges in our network.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

It attempted to perform a password spraying attack on the IMAP server.

This IP belongs to Gilead Sciences.

The IP made multiple requests with the same Proxy-Authorization header.

This IP belongs to Bell Canada.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It attempted to perform a SIPVicious scan on the Asterisk server.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

It persistently tried to exploit weaknesses in the SSH communication encryption.

Multiple requests with the same If-Match header.

This IP belongs to Korea Telecom.

The IP address has been associated with unwanted browser toolbar installations.

It attempted to use the POP3 server to relay phishing emails.

The IP address initiated multiple unsuccessful login attempts.