It attempted to perform a SSDP amplification attack on the SSH server.

Attempts to access the server using unusual HTTP methods or request types.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

The IP was flagged for performing XML External Entity attacks, exploiting improperly processed XML inputs.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

Multiple requests with the same Referer header.

This IP belongs to Dell Technologies.

The IP attempted to use the FTP server to distribute network mapping tools.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

This IP belongs to TELUS Communications.

Unusually high number of requests to a specific service or application within the server.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

Multiple requests with the same Expect header.

This IP belongs to Johnson & Johnson.

The IP performed regular system foot printing to gain intel on weak points in our server.

Incriminating activities involving the distribution of trojan horses were linked to this IP address.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

This IP belongs to Hong Kong Broadband Network.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! Recu Dimanche 26 Janvier 2025 après 03h24 (toujours envoyés les nuits, les week-ends, la veille au soir ) 3ème mail escroc usurpant MONDIAL RELAY venant de l’adresse mail escroc: info@tissotsaattamiri.com utilisant encore des boites mails amazonses.com et adresse IP 54.240.3.11 gérée par email-abuse@amazon.com Received : from a3-11.smtp-out.eu-west-1.amazonses.com (a3-11.smtp-out.eu-west-1.amazonses.com [54.240.3.11]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0111.laposte.net (SMTP Server) with ESMTPS id 4Ygb3X72NczTgCZ for <@laposte.net>; Sun, 26 Jan 2025 03:24:40 +0100 (CET) JE N’AI RIEN COMMANDé = mails escrocs. ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <01020194a06ced2a-ce1ca391-2ec9-4362-bf1d-df4a590b0aaa-000000@eu-west-1.amazonses.com> Received : from mlpnf0111.laposte.net (mlpnf0111.sys.meshcore.net [10.94.128.90]) by mlpnb0108 with LMTPA; Sun, 26 Jan 2025 03:24:41 +0100 X-Cyrus-Session-Id : cyrus-88966-1737858281-1-5876990213046304155 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1737858281; cv=none; b=eMYmwvT/fHoYvHirS4fWypsi6ItnsqENdGWJF7QVLzbPjcAiDnJnVu4OPlU6zdOIN5EzewY/YtY GpdlKg11VqjBwjX4Y6EFG7c6HUyC1d627w8fjd9u+qnIeN1XLwlRukp0O9Z4KXRUJAgTlfsoHQG7 Ilf9XwIOutgvO/Yy/jQ23JYDU8uWZ79wy+UOgo0S7GWWArh9olmjR6nBLMSmXUnEuM6NV9yxg5AY xM1Rbp0QvUw0y03Mrhl9FkH8uZjFMVflLimrLvZYsjXlTUOVqN5NvEFhIXTINOUsKt1agl0zIt+2 KQqJsvt8G1nKmTnsMzeVpaebvVAxjSnOZIWbmqg== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1737858281; h=DKIM-Signature:DKIM-Signature:From:To:Subject:Date; bh=Is+a44+zVrcSsugsYEP3qSdutj0Un5WLWKHbGfXXLUc=; b=U1L82CSdlGCF5rv/VqyvGWzIBf

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP attempted to use the POP3 server to relay spam.