Multiple requests with the same TE (Transfer Encoding) header.

This IP belongs to Amazon.

It attempted to send emails with malicious links from the Postfix server.

Evidence shows that the IP address has sent a number of deceptive phishing emails to our employees.

It attempted to make unauthorized calls using the VOIP server.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

The IP address attempted to login to the IMAP server with an invalid username.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

This IP belongs to General Motors.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP, accounts and mails boxes ! Recu Mercredi 12 Fevrier 2025 après 18h47 3 ème Mails escrocs usurpant encore les NOTAIRES de FRANCE et venant de l’adresse Mail débile: noreply@xlord.co gérée par abuse@godaddy.com Et avec adresses IP utilisées 81.171.20.122 gérée par abuse@nl.leaseweb.com mais vraie adresse IP originale: 41.250.61.247 au MAROC gérée par abusepoc@afrinic.net Received : from [41.250.61.247] Received : from server.xlord.co (server.xlord.co [81.171.20.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0116.laposte.net (SMTP Server) with ESMTPS id 4YtQk74BkZz1GBvc IP Lookup Details: IP Information - 81.171.20.122 Host name: server.xlord.co Country: Netherlands Country Code: NL Region: City: Latitude: 52.3824 Longitude: 4.8995 ******************* Contenu du mail des hackers *************** documents d'acquisition • Aujourd'hui, à 18:47 (il y a une heure) 7Ko • • • N De : notaire • A : Moi • Madame, Monsieur Nous avons le plaisir de vous informer que le rapport relatif à votre dossier est désormais disponible en téléchargement sécurisé. Pour accéder au document, veuillez utiliser les informations suivantes :

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

It attempted to use the IMAP server to relay spam.

This IP belongs to Fannie Mae.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

The IP attempted to use the FTP server to distribute keylogging software.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

This IP belongs to Google Cloud Services.

It attempted to upload malicious files to the SSH server.

It attempted to send emails from the Mail server to a large number of recipients.

The IP made multiple requests to the password reset page.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).