Several phishing emails have been traced back to this suspicious IP address.

Unusual patterns in user agent strings.

This IP belongs to KDDI.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

This IP belongs to Rogers Cable.

This IP was detected distributing spyware-infected USB drives to our users.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

The IP address has been linked to the creation of artificial traffic to crash our website.

GET /backup.sql: Attempting to access a backup of your database.

The IP attempted to perform Session Fixation attacks on the Apache server.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

It attempted command injection attacks, hoping to execute unauthorized commands.

This IP belongs to Exelon.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

It attempted to perform a Chargen amplification attack on the SSH server.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to UnitedHealth Group.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! Recu Lundi 14 Avril 2025 après 22h23 (toujours envoyés les nuits, les week-ends, la veille au soir) 4 ème mail escroc usurpant MONDIAL RELAY venant de l’adresse mail escroc: bonsoir@ses.oberst.com et utilisan encore des boites mails amazonses.com et adresse IP 54.240.9.54 gérée par email-abuse@amazon.com Received : from a9-54.smtp-out.amazonses.com (a9-54.smtp-out.amazonses.com [54.240.9.54]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0120.laposte.net (SMTP Server) with ESMTPS id 4ZbzHq4wvFznTVN IP Lookup Details: IP Information - 54.240.9.54 Host name: a9-54.smtp-out.amazonses.com Country: United States Country Code: US Region: WA City: Seattle Latitude: 47.5839 Longitude: -122.2995 JE N’AI RIEN COMMANDé = mails escrocs. ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <0100019635f83b38-23cab2eb-0ddd-47b9-84dd-abe5942b1506-000000@amazonses.com> Received : from mlpnf0120.laposte.net (mlpnf0120.sys.meshcore.net [10.94.128.99]) by mlpnb0108 with LMTPA; Mon, 14 Apr 2025 22:23:03 +0200 X-Cyrus-Session-Id : cyrus-64555-1744662183-1-9498000742900032811 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1744662183; cv=none; b=O0RIJt9i3TRqX4YBpjO/16jKsBciAeX5+66D/RYNrWkS3KwLAXzGiFNghVr2rU3zyXGNxB/Elam 37ZDoxp2gIXtM2+Kb5BD0+Njz3WxAzs5is6kDi7Xoe4IQMLZnb+kILw93YBeiYBpb5cnnqnDydf+ zi+e29X38QPQVzItBSqwhOrMOka5QU/b2/aErL+KCWL2VUjeYv+Iod7PAHXR2Zr5611sPNTZa0Bj hlM5ypDJWUHHvfFJI/ENGbYj5ED5nz16uwukFCi6JpvfMRDYgaRjAozF3DV666YzZyy31hoSBLtj pR4vdtdLUjs8GuP3mv5CeLaZzX4GrvHVpgqp0cQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1744662183; h=DKIM-Signature:DKIM-Signature:Date:To:Subject:From; bh=GIyzlgQVNKaKxZtM+4yznKWRq+AWSCpX6nA2k5L/Lz4=; b=XPlfIGABGgy5jNpsablE4N5VMN MrQIkjubrHdbhMBnn+kl76BkEvQ/Yk1WPmOQU5icfsTLPhs0Au/cCAlxDJvscfFzBd6fHZ25cOCA zxRqCAV7tRhqXVJ/CV9iECBzr7uM4kHoRXy3e2LIq8QvpBra2plmhozwN/98hgmAaAu8x/I6b3bI C/b/9m6nvaQds287pJNyiypMpLTvr05zGSoTA8l27Ydir8qlYhLheak5Xl+54lDmUEcUNtXnY0rv DwP0vvgg1eheKy0HZRei0KAmUjl2iqsTNLJXBKMPAOEHV2hdqDN/YJP9AGAu5FbFMJUyKQeI345H Y84JrhU0FWXg== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=a9-54.smtp-out.amazonses.com smtp.mailfrom=0100019635f83b38-23cab2eb-0ddd-47b9-84dd-abe5942b1506-000000@amazonses.com; dkim=pass reason="good signature" header.b=M/UTDV header.d=ses.oberst.com header.s=4t6etxk6eiqcedbbinqpb4kqv56lejdy; dkim=pass reason="good signature" header.b=esGCp/ header.d=amazonses.com header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; dmarc=pass reason="SPF is not aligned, DKIM is aligned"; arc=none smtp.remote-ip=54.240.9.54; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.9.1","queueID":"4ZbzHq6JKyznTVP","contextId": "0e77c4c9-673c-4a6f-a9e7-fb310a25dd43"} X-ppbforward : {"queueID":"4ZbzHq6JKyznTVP","server":"mlpnf0120"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0120.laposte.net (SMTP Server) with ESMTP id 4ZbzHq6JKyznTVP for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Mon, 14 Apr 2025 22:23:03 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4ZbzHq4wvFznTVN","contextId": "c66b9cf5-ace0-40e1-9f1a-b0eb41ec3bde"} X-lpn-mailing : WHITELISTED X-lpn-spamrating : 0 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=0100019635f83b38-23cab2eb-0ddd-47b9-84dd-abe5942b1506-000000@amazonses.com smtp.helo=a9-54.smtp-out.amazonses.com; dkim=pass reason="good signature" header.d=ses.oberst.com header.s=4t6etxk6eiqcedbbinqpb4kqv56lejdy header.b=M/UTDV; dkim=pass reason="good signature" header.d=amazonses.com header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw header.b=esGCp/; dmarc=pass reason="SPF is not aligned, DKIM is aligned"; arc=none smtp.remote-ip=54.240.9.54; bimi=skipped reason="non-compliant DMARC" Received : from a9-54.smtp-out.amazonses.com (a9-54.smtp-out.amazonses.com [54.240.9.54]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0120.laposte.net (SMTP Server) with ESMTPS id 4ZbzHq4wvFznTVN

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

This IP belongs to Berkshire Hathaway.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.