The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

It made numerous requests to the same endpoint in a short time.

This IP belongs to UnitedHealth Group.

This IP directed malicious network traffic to our servers with the intent to crash them.

It attempted to use the FTP server to distribute encryption tools.

The malicious IP conducted HTTP verb tampering, exploiting varying responses to different HTTP methods.

This IP belongs to ConocoPhillips.

The IP attempted to perform a distributed denial of service attack on the SSH server.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP, accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, comptes et boites mails ! Recu ce Mardi 11 Fevrier 2025 après 08h06 ( envoyés toujours les nuits ou les week-ends ) 2 èmes MAILs escrocs usurpant encore les NOTAIRES de FRANCE et venant de l’adresse Mail bidon supportinfo@adnep.org avec adresses IP utilisées: 44.202.169.35 gérée abuse@proofpoint.com mais vraie adresse IP originale : 41.250.61.247 au MAROC gérée par abusepoc@afrinic.net Received : X-Source-IP : 41.250.61.247 IP Lookup Details: IP Information - 41.250.61.247 Host name: 41.250.61.247 Country: Morocco Country Code: MA Region: 45 City: Casablanca Latitude: 33.5928 Longitude: -7.6192 **************** CODES HTML des hackers ******************** Return-Path : <supportinfo@adnep.org> Received : from mlpnf0105.laposte.net (mlpnf0105.sys.meshcore.net [10.94.128.84]) by mlpnb0108 with LMTPA; Tue, 11 Feb 2025 08:06:28 +0100 X-Cyrus-Session-Id : cyrus-58470-1739257588-4-9957535823283086057 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1739257588; cv=none; b=SDOyojgYH/NI8Dzj9/U3YlJWPFBeMqiLRXFXO2x8qubTzO4Q39uwhmsZFuWLbHlU+PXznQCdWZu U64Lw/aNoNA/GChBRHK47053gffjij1/N0mtUe/OGjn+lZfqNsTDdKzZ+DkbOEaX2Lml88OuUrIV VcEgG/c4gFCV8Y6/AStQnE0CFL69XxS9my3cymwwaQ7qhq71WU2SHUhtOhkJYRvZChUS7DeJo/6b q2EEAxd68tJHGJW774xVPMGyBo3GMBQWe0iQFeNGLEGdaz71wV5rO7W/MuBPwsWkyX3410pPhF4f gvX1k3neQBjppMZFcgJAjK21lxxuZI7FgiqFouw== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1739257588; h=DKIM-Signature:From:Date:Subject:To; bh=kzgJnQOs1 8TFl97lWBYpSzhJd6iParzAKq3wqDict6w=; b=EigxE82m5f8XPfBkBpUVVmnWEDNRN0dKOJyIN iPH0CZVOAX8JvbA+S6ePDmAWq5g2YcIt3PsbhjZA7BjRrV3d1klPBbDmnJfLtbWHk5LDGt+KBhH7 RxUgqljuhhK8Dpr3fTfrBcT01whB4LPkIg0JBgAPVXpg6Pjkp1X5NUrxhwXKSCpr6FcwbL6pFZFu bgRuc1bgRSGJDrgtCVT2bhk9gTJUxuReD39JfKdxlUZfQzzmscIlBU9pnbcXsttJJbaNQnZKYBV6 lNWTOfll5eUYHzvj70KUEZCMEW5A9N63lgGR6M0I1UiKsryoKde1p2uGdK0j0CbvXtoHNOkytEGu w== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=omta036.useast.a.cloudfilter.net smtp.mailfrom=supportinfo@adnep.org; dkim=pass reason="good signature" header.b=m0KTjY header.d=adnep.org header.s=default; dmarc=none reason="No policy found"; arc=none smtp.remote-ip=44.202.169.35; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4YsXYJ2rSLznTV5","contextId": "2bdb53db-a995-4f4c-b919-b94bf30c1c4e"} X-ppbforward : {"queueID":"4YsXYJ2rSLznTV5","server":"mlpnf0105"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0105.laposte.net (SMTP Server) with ESMTP id 4YsXYJ2rSLznTV5 for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 11 Feb 2025 08:06:28 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4YsXYJ1C9mznTTy","contextId": "d889dd44-bc9e-4c03-a56f-0bc4eb259adb"} X-lpn-mailing : LEGIT X-lpn-spamrating : 49 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=supportinfo@adnep.org smtp.helo=omta036.useast.a.cloudfilter.net; dkim=pass reason="good signature" header.d=adnep.org header.s=default header.b=m0KTjY; dmarc=none reason="No policy found"; arc=none smtp.remote-ip=44.202.169.35; bimi=skipped reason="non-pass DMARC" X-lpn-spamcause : OK,

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP, accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, comptes et boites mails ! Recu ce Mardi 11 Fevrier 2025 après 08h06 ( envoyés toujours les nuits ou les week-ends ) 2 èmes MAILs escrocs usurpant encore les NOTAIRES de FRANCE et venant de l’adresse Mail bidon: supportinfo@adnep.org avec adresses IP utilisées: 44.202.169.35 gérée abuse@proofpoint.com mais vraie adresse IP originale : 41.250.61.247 au MAROC gérée par abusepoc@afrinic.net Received : X-Source-IP : 41.250.61.247 IP Lookup Details: IP Information - 41.250.61.247 Host name: 41.250.61.247 Country: Morocco Country Code: MA Region: 45 City: Casablanca Latitude: 33.5928 Longitude: -7.6192 ******************* Contenu du mail des hackers *************** documents d'acquisition • Aujourd'hui, à 08:06 (il y a une heure) 8Ko • • • N De : notaire • A : Moi • Madame, Monsieur Nous avons le plaisir de vous informer que le rapport relatif à votre dossier est désormais disponible en téléchargement sécurisé. Pour accéder au document, veuillez utiliser les informations suivantes : Télécharger le document sécurisé nous vous souhaiton une bonne réception du présent mail, cordialement. **************** CODES HTML des hackers ******************** Return-Path : <supportinfo@adnep.org> Received : from mlpnf0105.laposte.net (mlpnf0105.sys.meshcore.net [10.94.128.84]) by mlpnb0108 with LMTPA; Tue, 11 Feb 2025 08:06:28 +0100 X-Cyrus-Session-Id : cyrus-58470-1739257588-4-9957535823283086057 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1739257588; cv=none; b=SDOyojgYH/NI8Dzj9/U3YlJWPFBeMqiLRXFXO2x8qubTzO4Q39uwhmsZFuWLbHlU+PXznQCdWZu U64Lw/aNoNA/GChBRHK47053gffjij1/N0mtUe/OGjn+lZfqNsTDdKzZ+DkbOEaX2Lml88OuUrIV VcEgG/c4gFCV8Y6/AStQnE0CFL69XxS9my3cymwwaQ7qhq71WU2SHUhtOhkJYRvZChUS7DeJo/6b q2EEAxd68tJHGJW774xVPMGyBo3GMBQWe0iQFeNGLEGdaz71wV5rO7W/MuBPwsWkyX3410pPhF4f gvX1k3neQBjppMZFcgJAjK21lxxuZI7FgiqFouw== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1739257588; h=DKIM-Signature:From:Date:Subject:To; bh=kzgJnQOs1 8TFl97lWBYpSzhJd6iParzAKq3wqDict6w=; b=EigxE82m5f8XPfBkBpUVVmnWEDNRN0dKOJyIN iPH0CZVOAX8JvbA+S6ePDmAWq5g2YcIt3PsbhjZA7BjRrV3d1klPBbDmnJfLtbWHk5LDGt+KBhH7 RxUgqljuhhK8Dpr3fTfrBcT01whB4LPkIg0JBgAPVXpg6Pjkp1X5NUrxhwXKSCpr6FcwbL6pFZFu bgRuc1bgRSGJDrgtCVT2bhk9gTJUxuReD39JfKdxlUZfQzzmscIlBU9pnbcXsttJJbaNQnZKYBV6 lNWTOfll5eUYHzvj70KUEZCMEW5A9N63lgGR6M0I1UiKsryoKde1p2uGdK0j0CbvXtoHNOkytEGu w== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=omta036.useast.a.cloudfilter.net smtp.mailfrom=supportinfo@adnep.org; dkim=pass reason="good signature" header.b=m0KTjY header.d=adnep.org header.s=default; dmarc=none reason="No policy found"; arc=none smtp.remote-ip=44.202.169.35; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4YsXYJ2rSLznTV5","contextId": "2bdb53db-a995-4f4c-b919-b94bf30c1c4e"} X-ppbforward : {"queueID":"4YsXYJ2rSLznTV5","server":"mlpnf0105"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0105.laposte.net (SMTP Server) with ESMTP id 4YsXYJ2rSLznTV5 for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 11 Feb 2025 08:06:28 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4YsXYJ1C9mznTTy","contextId": "d889dd44-bc9e-4c03-a56f-0bc4eb259adb"} X-lpn-mailing : LEGIT X-lpn-spamrating : 49 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=supportinfo@adnep.org smtp.helo=omta036.useast.a.cloudfilter.net; dkim=pass reason="good signature" header.d=adnep.org header.s=default header.b=m0KTjY; dmarc=none reason="No policy found"; arc=none smtp.remote-ip=44.202.169.35; bimi=skipped reason="non-pass DMARC" X-lpn-spamcause : OK, (49)(0000)gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdegtdefgecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfntefrqffuvffgpdggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecuogfuuhhsphgvtghtffhomhgrihhnucdlgeelmdenucfjughrpefhfffukffvgggtsegrtderredttdejnecuhfhrohhmpehnohhtrghirhgvuceoshhuphhpohhrthhinhhfohesrggunhgvphdrohhrgheqnecuggftrfgrthhtvghrnheptefhhfehtdelgfettdejtedvueetkedutdduvedtudduleetuedttdehgeelvdeknecuffhomhgrihhnpehsvghlfhhiphdrtghomhenucfkphepgeegrddvtddvrdduieelrdefhedpgedurddvhedtrdeiuddrvdegjeenucevlhhushhtvghrufhiiigvpedunecurfgrrhgrmhepihhnvghtpeeggedrvddtvddrudeiledrfeehpdhhvghlohepohhmthgrtdefiedruhhsvggrshhtrdgrrdgtlhhouhgufhhilhhtvghrrdhnvghtpdhmrghilhhfrhhomhepshhuphhpohhrthhinhhfohesrggunhgvphdrohhrghdpnhgspghrtghpthhtohepuddprhgtphhtthhopegvlhgvrdhlvghmohhinhgvsehlrghpohhsthgvrdhnvghtpdhsphhfpehprghsshdpughkihhmpehprghsshdpughmrghrtgepnhhonhgvpdhrvghvkffrpehomhhtrgdtfeeirdhushgvrghsthdrrgdrtghlohhuughfihhlthgvrhdrnhgvthdpghgvohf krfepfgfu Received : from omta036.useast.a.cloudfilter.net (omta036.useast.a.cloudfilter.net [44.202.169.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0105.laposte.net (SMTP Server) with ESMTPS id 4YsXYJ1C9mznTTy

This IP belongs to Publix Super Markets.

We identified the IP address as a source of numerous scare tactics spyware.

It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

This IP belongs to DuPont de Nemours.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

This IP belongs to Dow Chemical.

This IP belongs to Reliance Jio.

This IP belongs to Hostgator.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

The IP attempted to perform a dictionary attack on the IMAP server.

It made multiple requests with the same Expect header.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

It tried to execute dictionary attacks on our Mail service causing potential delays.