It launched a SYN flood attack, aiming to consume server resources and disrupt services.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP, accounts and mails boxes ! Recu Mardi 18 Fevrier 2025 après 02h41 ( très souvent les nuits ) 4ème Mails escrocs ( fautes ) usurpant encore les NOTAIRES de FRANCE et venant de l’adresse Mail bidon: teambackend840@gmail.com gérée par abuse@gmail.com avec adresse IP utilisée 209.85.221.53 Received : from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0111.laposte.net (SMTP Server) with ESMTPS id 4Yxj0Y1LKGzTgC3 for <ele.lemoine@laposte.net>; Tue, 18 Feb 2025 02:41:01 +0100 (CET) Received : by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-38f3486062eso1975903f8f.0 Received : from [192.168.11.161] ([196.127.18.122]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-38f259d5923sm13713652f8f.74.2025.02.17.17.40.58 IP Lookup Details: IP Information - 209.85.221.53 Host name: mail-wr1-f53.google.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 ******************* Contenu du mail des hackers **************************** Documents N°12-1A • Aujourd'hui, à 02:41 (il y a 7 heures) 8Ko • • • N De : notaire • A : Moi • Cet email a été détecté comme potentiellement dangereux. Les liens ont été désactivés. Réactiver les liens Madame, Monsieur Nous avons le plaisir de vous informer que le rapport relatif à votre dossier est désormais disponible en téléchargement sécurisé. Pour accéder au document, veuillez utiliser les informations suivantes : ************************************ **************** CODES HTML des hackers *********************** Return-Path : <teambackend840@gmail.com> Received : from mlpnf0111.laposte.net (mlpnf0111.sys.meshcore.net [10.94.128.90]) by mlpnb0108 with LMTPA; Tue, 18 Feb 2025 02:41:01 +0100 X-Cyrus-Session-Id : cyrus-118862-1739842861-1-15958514954804032883 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1739842861; cv=none; b=Nf2ORXgfF2EYOP2MflOxootRsDMD0l/JKD7tnBDk9bwTRSD/QawTxSR1vbURtEtUgUkSA/KoYOc +NVupZM68XX934TTHTK0wgsU4US+L517+ks7Oe4oeKiIrATSUDw4v8vGrCYU6WLrDbk+7zf0u3eu DHcWYuqPtRnG9L5bdiFk45o54wmHfvwTZ6Siz7i1pTiX2hNdIDuHr8+kdPZlDBQSPosxk2Nh/WEB j/sHi0jI3b83ELnQy6POrcpfDLMzEb6N9w9HmJsfTqz9mljugXtHqH3tvJyJNLj9EdxNByPU8D19 7cHTGpZrqAS8LKbIMTF87yFZAyLcy9Jn88KJfcg== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1739842861; h=DKIM-Signature:From:Date:Subject:To; bh=0F70sc0ne ETW6DnLXdq2hvNOo4jqWCml7MH0jBOz/xE=; b=MLwsQjuaHFsyRFvuV6zFUr/aE69J/TPKXpFVV Tl85Q2sFy0icNh8xXIKX3vPVnGHZKzB7bt+L9qh1rSEUXUShi5lKUAATFIN93+NqHe2oyjKliHc4 Mc0EktuB1Q0qu/14TfOCWZlcFKU5B3BlKqDsN57ao/Pigx3vvnt985cH8ZB3f2ODUf12O5boLHJd MI7Ai4OL/8lk5MeidAc8CnjxTghTrXO4WPdWIk/TdNGg+S6PGPDxxo/vVRN2TU8T1zdaPIZQKXpX NdiyXg/q9uLAUghcCGVT3WPYIWjkFSsXZ2fZ/yEpRySHgxGhR6O9mwUfIzHDvkm3OxL8xjG7GPzt A== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wr1-f53.google.com smtp.mailfrom=teambackend840@gmail.com; dkim=pass reason="good signature" header.b=GGgJJQ header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.53; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4Yxj0Y2YC4zTgCG","contextId": "34b0b345-994c-40ff-a8b5-f60efc76c277"} X-ppbforward : {"queueID":"4Yxj0Y2YC4zTgCG","server":"mlpnf0111"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0111.laposte.net (SMTP Server) with ESMTP id 4Yxj0Y2YC4zTgCG for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 18 Feb 2025 02:41:01 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4Yxj0Y1LKGzTgC3","contextId": "2825d5c7-f52a-495f-b750-59bb919740be"} X-lpn-mailing : LEGIT X-lpn-spamrating : 49 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=teambackend840@gmail.com smtp.helo=mail-wr1-f53.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=GGgJJQ; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.53; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (49)(0000)gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdeitddttdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfntefrqffuvffgpdggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecuogfuuhhsphgvtghtffhomhgrihhnucdlgeelmdenucfjughrpefhfffukffvgggtsegrtderredttdejnecuhfhrohhmpehnohhtrghirhgvuceothgvrghmsggrtghkvghnugekgedtsehgmhgrihhlrdgtohhmqeenucggtffrrghtthgvrhhnpefgfeejgfefvdffjeevtdegvdfgteffueeiieeljeeiheejhfetvedugeegffegkeenucffohhmrghinhepshgvlhhfihhprdgtohhmnecukfhppedvtdelrdekhedrvddvuddrheefpdduleeirdduvdejrddukedruddvvdenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedvtdelrdekhedrvddvuddrheefpdhhvghlohepmhgrihhlqdifrhduqdhfheefrdhgohhoghhlvgdrtghomhdpmhgrihhlfhhrohhmpehtvggrmhgsrggtkhgvnhgukeegtdesghhmrghilhdrtghomhdpnhgspghrtghpthhtohepuddprhgtphhtthhopegvlhgvrdhlvghmohhinhgvsehlrghpohhsthgvrdhnvghtpdhsphhfpehprghsshdpughkihhmpehprghsshdpughmrghrtgepphgrshhspdhrvghvkffrpehmrghilhdqfihruddqfhehfedrghhoohhglhgvrdgtohhmpdhgvghokffrpegfuf Received : from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0111.laposte.net (SMTP Server) with ESMTPS id 4Yxj0Y1LKGzTgC3

The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

This IP belongs to Pfizer.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

This IP belongs to Microsoft.

The IP sent numerous Asterisk OPTIONS requests in a short time.

This IP belongs to Kraft Heinz.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

Repeated attempts to access rarely used or hidden services on the server.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

This IP belongs to Wells Fargo.

This IP belongs to Freddie Mac.

It attempted to perform a phishing attack using the IMAP server.

Executed email spoofing attempts pretending to be a trusted party.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

It attempted to use the FTP server to distribute phishing emails.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

The IP attempted to bypass the SASL server's authentication mechanism.