Recu Mercredi 26 Fevrier 2025 après h (toujours envoyés les nuits ou les week-ends) 22ème mail escroc ( fautes ) usurpant encore la BANQUE POSTALE et venant de l’adresse mail bidon des hackers: vaticaindia@gmail.com utilisant encore les serveurs GOOGLE et venant encore de l’adresse IP 209.85.128.43 aux U.S.A gérée par Google : network-abuse@google.com mais vraies adresses IP au MAROC: from [192.168.11.161] [196.117.68.221] gérées par ORANGE au MAROC : isp_oma@orange.ma Received : from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0103.laposte.net (SMTP Server) with ESMTPS id 4Z2fqr5N8bz7t7h for <ele.lemoine@laposte.net>; Wed, 26 Feb 2025 04:20:40 +0100 (CET) Received : by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-438a39e659cso41692815e9.2 IP Lookup Details: IP Information - 209.85.128.43 Host name: mail-wm1-f43.google.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 ************** Codes HTML des hackers ci-dessous ************ Return-Path : <vaticaindia@gmail.com> Received : from mlpnf0103.laposte.net (mlpnf0103.sys.meshcore.net [10.94.128.82]) by mlpnb0108 with LMTPA; Wed, 26 Feb 2025 04:20:40 +0100 X-Cyrus-Session-Id : cyrus-255421-1740540040-1-8196854632978148036 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1740540040; cv=none; b=YPi94xNazeVt2HAPabwVy4eqqCyqUJLw6pqcSiWlLPljpjvd22FzEXy0v6TUsyHtRx2dzt9ozfx XbbUfZAP3UgH3FBKDp+Qadtv2Oqqds24SdZhBqp6Su7gje0GPKFwb0HEwLy1J3NtJA6GmwSL/awB 2xsUKVI/VrsXV2hsHFOD37/T+poV7b2TEO6Q8BiXFc8t6h7edDpHgYUza9JD8ZuXK/YBOhgXD24G JqDi1oH0PQpCotJes1topwl43qUUCTt4jwcYHz30cqY4KsuL5fO4Ye8wlHr4vljZdYM5S6h67SH3 pRkRILr1TzBmc41rAFSt+9RM5WpgF6K44vWomkA== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1740540040; h=DKIM-Signature:From:Date:Subject:To; bh=aTDL1lcHB qc213avzo3I5aWg9Wb0KiDeqcPY2A83l34=; b=U+r0rskunlQUr6OhkqF/j6lWza1i/u/I5Hkh3 eV6Mi5LJOUPetbELVgpIcNrUwd0Xpwlpo9F/QO2KSOsWMnSdjHPTBM/HEgr0PSUObJarF2pxari2 BlwdKSj0n7wwBpoBssJD8eWitwjn9yRUJjZsR0tnhtyRwQ0lXvIM69MtVdQt7byweIDWFCKBOeyS lwzVF1EuzlmeqXnYOXy89IwWHS3TC4zmn/B31HONfcDHPLO6V37LB/dsCOiCObc2UjkYVi7APwgN lVBrlzWl2ZXXJPeXDbd6GAHT2cQxBRgPynlpsNovbO79wEwGoEijKjgjR90SzOaFT3H9Uq+ETQPh w== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wm1-f43.google.com smtp.mailfrom=vaticaindia@gmail.com; dkim=pass reason="good signature" header.b=Kft6c5 header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.128.43; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4Z2fqr6JRTz7t7m","contextId": "f7e2d0f7-4c5c-4765-9630-93b33c513853"} X-ppbforward : {"queueID":"4Z2fqr6JRTz7t7m","server":"mlpnf0103"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0103.laposte.net (SMTP Server) with ESMTP id 4Z2fqr6JRTz7t7m for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Wed, 26 Feb 2025 04:20:40 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4Z2fqr5N8bz7t7h","contextId": "ca91fb2d-6394-4c8b-b8e8-96505ea52a9c"} X-lpn-mailing : LEGIT X-lpn-spamrating : 49 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=vaticaindia@gmail.com smtp.helo=mail-wm1-f43.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=Kft6c5; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.128.43; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (49)(0000)gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdekfeegkecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfntefrqffuvffgpdggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecuogfuuhhsphgvtghtffhomhgrihhnucdlgeelmdenucfjughrpefhfffukffvgggtsegrtderredttdejnecuhfhrohhmpehnohhtihhfihgtrghtihhonhcuoehvrghtihgtrghinhguihgrsehgmhgrihhlrdgtohhmqeenucggtffrrghtthgvrhhnpefgkedvfeejueekuddugeeiheeitdfgtdekveegveduueejgfelteeivdefveejveenucffohhmrghinhepshgvrhhvvghfthhprdhnvghtnecukfhppedvtdelrdekhedruddvkedrgeefpdduleeirdduudejrdeikedrvddvudenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedvtdelrdekhedruddvkedrgeefpdhhvghlohepmhgrihhlqdifmhduqdhfgeefrdhgohhoghhlvgdrtghomhdpmhgrihhlfhhrohhmpehvrghtihgtrghinhguihgrsehgmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepvghlvgdrlhgvmhhoihhnvgeslhgrphhoshhtvgdrnhgvthdpshhpfhepphgrshhspdgukhhimhepphgrshhspdgumhgrrhgtpehprghsshdprhgvvhfkrfepmhgrihhlqdifmhduqdhfgeefrdhgohhoghhlvgdrtghomhdpghgvohfkrfepfgfu Received : from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0103.laposte.net (SMTP Server) with ESMTPS id 4Z2fqr5N8bz7t7h

Recu Mercredi 26 Fevrier 2025 après h (toujours envoyés les nuits ou les week-ends) 22ème mail escroc ( fautes ) usurpant encore la BANQUE POSTALE et venant de l’adresse mail bidon des hackers: vaticaindia@gmail.com utilisant encore les serveurs GOOGLE et venant encore de l’adresse IP 209.85.128.43 aux U.S.A gérée par Google : network-abuse@google.com mais vraies adresses IP au MAROC: from [192.168.11.161] [196.117.68.221] gérées par ORANGE au MAROC : isp_oma@orange.ma Received : from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0103.laposte.net (SMTP Server) with ESMTPS id 4Z2fqr5N8bz7t7h for <ele.lemoine@laposte.net>; Wed, 26 Feb 2025 04:20:40 +0100 (CET) Received : by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-438a39e659cso41692815e9.2 IP Information - 209.85.128.43 Host name: mail-wm1-f43.google.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 IP Information - 196.117.68.221 Host name: 196.117.68.221 Country: Morocco Country Code: MA Region: 49 City: Rabat Latitude: 34.0138 Longitude: -6.8443 ************** Codes HTML des hackers ci-dessous ************ Return-Path : <vaticaindia@gmail.com> Received : from mlpnf0103.laposte.net (mlpnf0103.sys.meshcore.net [10.94.128.82]) by mlpnb0108 with LMTPA; Wed, 26 Feb 2025 04:20:40 +0100 X-Cyrus-Session-Id : cyrus-255421-1740540040-1-8196854632978148036 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1740540040; cv=none; b=YPi94xNazeVt2HAPabwVy4eqqCyqUJLw6pqcSiWlLPljpjvd22FzEXy0v6TUsyHtRx2dzt9ozfx XbbUfZAP3UgH3FBKDp+Qadtv2Oqqds24SdZhBqp6Su7gje0GPKFwb0HEwLy1J3NtJA6GmwSL/awB 2xsUKVI/VrsXV2hsHFOD37/T+poV7b2TEO6Q8BiXFc8t6h7edDpHgYUza9JD8ZuXK/YBOhgXD24G JqDi1oH0PQpCotJes1topwl43qUUCTt4jwcYHz30cqY4KsuL5fO4Ye8wlHr4vljZdYM5S6h67SH3 pRkRILr1TzBmc41rAFSt+9RM5WpgF6K44vWomkA== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1740540040; h=DKIM-Signature:From:Date:Subject:To; bh=aTDL1lcHB qc213avzo3I5aWg9Wb0KiDeqcPY2A83l34=; b=U+r0rskunlQUr6OhkqF/j6lWza1i/u/I5Hkh3 eV6Mi5LJOUPetbELVgpIcNrUwd0Xpwlpo9F/QO2KSOsWMnSdjHPTBM/HEgr0PSUObJarF2pxari2 BlwdKSj0n7wwBpoBssJD8eWitwjn9yRUJjZsR0tnhtyRwQ0lXvIM69MtVdQt7byweIDWFCKBOeyS lwzVF1EuzlmeqXnYOXy89IwWHS3TC4zmn/B31HONfcDHPLO6V37LB/dsCOiCObc2UjkYVi7APwgN lVBrlzWl2ZXXJPeXDbd6GAHT2cQxBRgPynlpsNovbO79wEwGoEijKjgjR90SzOaFT3H9Uq+ETQPh w== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wm1-f43.google.com smtp.mailfrom=vaticaindia@gmail.com; dkim=pass reason="good signature" header.b=Kft6c5 header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.128.43; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4Z2fqr6JRTz7t7m","contextId": "f7e2d0f7-4c5c-4765-9630-93b33c513853"} X-ppbforward : {"queueID":"4Z2fqr6JRTz7t7m","server":"mlpnf0103"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0103.laposte.net (SMTP Server) with ESMTP id 4Z2fqr6JRTz7t7m for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Wed, 26 Feb 2025 04:20:40 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4Z2fqr5N8bz7t7h","contextId": "ca91fb2d-6394-4c8b-b8e8-96505ea52a9c"} X-lpn-mailing : LEGIT X-lpn-spamrating : 49 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=vaticaindia@gmail.com smtp.helo=mail-wm1-f43.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=Kft6c5; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.128.43; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (49)(0000)gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdekfeegkecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfntefrqffuvffgpdggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecuogfuuhhsphgvtghtffhomhgrihhnucdlgeelmdenucfjughrpefhfffukffvgggtsegrtderredttdejnecuhfhrohhmpehnohhtihhfihgtrghtihhonhcuoehvrghtihgtrghinhguihgrsehgmhgrihhlrdgtohhmqeenucggtffrrghtthgvrhhnpefgkedvfeejueekuddugeeiheeitdfgtdekveegveduueejgfelteeivdefveejveenucffohhmrghinhepshgvrhhvvghfthhprdhnvghtnecukfhppedvtdelrdekhedruddvkedrgeefpdduleeirdduudejrdeikedrvddvudenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedvtdelrdekhedruddvkedrgeefpdhhvghlohepmhgrihhlqdifmhduqdhfgeefrdhgohhoghhlvgdrtghomhdpmhgrihhlfhhrohhmpehvrghtihgtrghinhguihgrsehgmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepvghlvgdrlhgvmhhoihhnvgeslhgrphhoshhtvgdrnhgvthdpshhpfhepphgrshhspdgukhhimhepphgrshhspdgumhgrrhgtpehprghsshdprhgvvhfkrfepmhgrihhlqdifmhduqdhfgeefrdhgohhoghhlvgdrtghomhdpghgvohfkrfepfgfu Received : from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0103.laposte.net (SMTP Server) with ESMTPS id 4Z2fqr5N8bz7t7h

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

This IP belongs to MTS (Mobile TeleSystems).

POST /db/images/: Attempt to post or insert a malicious file in the images directory of a database.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

This particular IP attempted to exploit vulnerabilities in our web applications.

This IP belongs to MTN.

This IP belongs to MTS (Mobile TeleSystems).

This IP was linked to an attempt at distributing malicious software within our system.

It attempted to use the FTP server to relay data to other systems.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

The IP was flagged for attempting dictionary attacks on our user accounts.

This IP belongs to ConocoPhillips.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

The IP attempted to perform a replay attack on the IMAP server.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

It attempted to use the FTP server to distribute brute force tools.

This IP belongs to Boeing.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.