There were several attempts from this IP to manipulate our server DNS records.

This IP belongs to Telus Communications.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

It attempted to perform a NTP amplification attack on the SSH server.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

This IP belongs to Bristol-Myers Squibb.

Recu Jeudi 17 Avril 2025 après 13h27 mail escroc usurpant usurpant LE TRESOR PUBLIC (Direction Générale des Finances Publiques) venant de l’adresse mail escroc: no-reply@grupotransita.net en utilisant des boites mails grupotransita.net gérées par abuse@name.com et adresse IP 51.83.242.7 gérée par nanakasasada@gmail.com et abuse@ovh.net Received : from opmta7.grupotransita.net (opmta7.grupotransita.net [51.83.242.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0110.laposte.net (SMTP Server) with ESMTPS id 4ZdbGn02y9z1nrwN C'est visiblement et clairement une tentative de phishing et fraude ( fautes multiples ) Ci-dessous cet email d’escroquerie avec ces en-têtes complets : ***************** CONTENU du mail d’escroquerie ******************* ne_pаs_rеpоndre@dgfіp.іmpοt • Aujourd'hui, à 13:27 (il y a 2 heures) 18Ko • • • NM De : nоuveаu messаgе • A : Moi • Vοus аvеz un nοuvеаu mеssаgе. Consultez-le ! Bonjour, Veuillez noter l'arrivée d'un nοuvеаu mеssаgе. Merci de le consulter dès que possible afin de rester informé. Accéder à mon espace Nοus vous rеmerсіоns pоυr votrе аttentіоn. ****************** Codes HTML des hackers ci-dessous ****************************** Return-Path : <no-reply@grupotransita.net> Received : from mlpnf0110.laposte.net (mlpnf0110.sys.meshcore.net [10.94.128.89]) by mlpnb0108 with LMTPA; Thu, 17 Apr 2025 13:27:45 +0200 X-Cyrus-Session-Id : cyrus-14121-1744889265-1-2947042150866162966 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1744889265; cv=none; b=TU3u+VMBtTawf3r9RMGjcIAxYjnhbc76foV+qHegYfbmknzAnDpnOpOk7INAP5v1JxuzM6O5wHF m4Z/ADpDy66tCb3q94BY0W9M0/HsifNPLxQZIVoTJ4cHhvaHDvAg5jBJnGPAtOlcc7b5FOcTQYaN JRfA4+JlWx0vV9y23hukjzeXfRmGDYV1XmM4FFVsR+cpjCuouQs0GPoisV46o50Hh17nTk7Ki6dP ZdosZeOuaTVDDguHHx1z4uR4a0HXLATKIDALxetH3cInHfOnK077x3Jz/KUHgmKwcCNBDQ/jwnBi 6MiG3VsndWllJZ/2HG9mhW7j+MKIPe1UjTMXSCA== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1744889265; h=DKIM-Signature:Date:To:From:Reply-To:Subject:List-Unsubscribe; bh=y6n0ABF8Za3tJ82+FGT1uXhu7mK/otfSX+EzQbi1QLM=; b=aKaIEl4QxjNPUvC1KB2wKMrCDS vMD5G6HU1g9ndFEqyb+YQUIEBeVAdrtaLUpdgbQnx1Di+TQX/MO+5MKZzB8HdQlzTkC7CJk0E2Ie JeV0ASASV+7PBk7d6jrxory4nWYzlspq6VpqIZ5vaNFNPecT+NJjBRXdZ2A8TPVcPI0LsnjVW+jE +/c+vL7j8XvfymSsOm29hEmWRfUY1NcIWz5NaSyerEtPBhnO8B+fxp2wzRkbUPmYTl3uPcVin+Xk N0IBS5W0JrNT5YwbuqoXkLhJIxXfOm+Xi8RZ96PAostBj7eRk1BhrVwTho031I+APLmyDv3RMsns Iug+icrvCohQ== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=opmta7.grupotransita.net smtp.mailfrom=no-reply@grupotransita.net; dkim=pass reason="good signature" header.b=OsY3V2 header.d=grupotransita.net header.i=no-reply@grupotransita.net header.s=dkim; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=51.83.242.7; bimi=none X-mail-filterd : {"version":"1.9.1","queueID":"4ZdbGn1s3nz1nrwS","contextId": "aca6b3a3-a03a-45d6-b79e-4afaa0a8b685"} X-ppbforward : {"queueID":"4ZdbGn1s3nz1nrwS","server":"mlpnf0110"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0110.laposte.net (SMTP Server) with ESMTP id 4ZdbGn1s3nz1nrwS for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Thu, 17 Apr 2025 13:27:45 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4ZdbGn02y9z1nrwN","contextId": "74406e2b-1321-4406-9e3a-a3bc8a884303"} X-lpn-mailing : LEGIT X-lpn-spamrating : 41 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=no-reply@grupotransita.net smtp.helo=opmta7.grupotransita.net; dkim=pass reason="good signature" header.d=grupotransita.net header.i=no-reply@grupotransita.net header.s=dkim header.b=OsY3V2; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=51.83.242.7; bimi=none X-List-Unsubscribe : <https://marketsfunnels.net/?mailpoet_page=subscriptions&mailpoet_router&endpoint=subscription&action=unsubscribe&data=eyJxdWV1ZUlkIjoyMywidG9rZW4iOiJqMzR1ZDlnNHpkdzAwOHNzY2tnMDBnYzQwODA4NHc0MCIsImVtYWlsIjoiZWxlLmxlbW9pbmVAbGFwb3N0ZS5uZXQifQ> X-lpn-spamcause : OK, (5)(0000)gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvvdeludegucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucgouegrugfjthhmlhdqqdfuuhhsphgvtghtlhhofidqufgthhgvmhgvqdeuqdhsvghpthculdehmdenucfjughrpeffvffhrhfukffojfggtgfgsegrkeerreehtdejnecuhfhrohhmpehnohhuvhgvrghuuchmvghsshgrghgvuceonhhoqdhrvghplhihsehgrhhuphhothhrrghnshhithgrrdhnvghtqeenucggtffrrghtthgvrhhnpeehteejveduuddtleefhefffefgudelvefhgfeiheevtddtgeeghfethfduffeijeenucffohhmrghinhepmhgrrhhkvghtshhfuhhnnhgvlhhsrdhnvghtnecukfhppeehuddrkeefrddvgedvrdejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthephedurdekfedrvdegvddrjedphhgvlhhopehophhmthgrjedrghhruhhpohhtrhgrnhhsihhtrgdrnhgvthdpmhgrihhlfhhrohhmpehnohdqrhgvphhlhiesghhruhhpohhtrhgrnhhsihhtrgdrnhgvthdpnhgspghrtghpthhtohepuddprhgtphhtthhopegvlhgvrdhlvghmohhinhgvsehlrghpohhsthgvrdhnvghtpdhsphhfpehprghsshdpughkihhmpehprghsshdpughmrghrtgepphgrshhspdhrvghvkffrpehophhmthgrjedrghhruhhpohht rhgrnhhsihhtrgdrnhgvthdpghgvohfkrfeprffn Received : from opmta7.grupotransita.net (opmta7.grupotransita.net [51.83.242.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0110.laposte.net (SMTP Server) with ESMTPS id 4ZdbGn02y9z1nrwN

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

This IP belongs to Microsoft.

This IP belongs to Tech Data.

The IP showed unusual patterns in session IDs.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

This IP belongs to United Technologies.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

It attempted to exploit known vulnerabilities in the SSH protocol.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

It made multiple requests with the same Expect header.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

GET /setup.php: Effort to locate setup files for PHP applications.

This IP belongs to Microsoft.

Multiple requests with the same DNT (Do Not Track) header.