It showed an unusually high number of requests to the login page.

This IP belongs to Exxon Mobil.

It was identified as a BadBot, a type of bot that performs malicious activities.

It attempted to perform a credential stuffing attack on the SASL server.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

This IP belongs to Telefonica Spain.

This IP belongs to Alphabet.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! Recu Samedi 19 Avril 2025 après 22h08 ( toujours envoyés les nuits, les week-ends, la veille au soir) 5 ème mail escroc usurpant MONDIAL RELAY venant de l’adresse mail escroc noreply@wavveststg.com utilisant encore des boites mails amazonses.com et adresse IP 23.251.246.11 gérée par email-abuse@amazon.com Received : from e246-11.smtp-out.eu-west-3.amazonses.com (e246-11.smtp-out.eu-west-3.amazonses.com [23.251.246.11]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0103.laposte.net (SMTP Server) with ESMTPS id 4Zg2lH0WZjz7t7Z JE N’AI RIEN COMMANDé = mails escrocs. ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <011301964fab26ca-0d6241d5-27a9-4395-928d-7f232cbda4a0-000000@eu-west-3.amazonses.com> Received : from mlpnf0103.laposte.net (mlpnf0103.sys.meshcore.net [10.94.128.82]) by mlpnb0108 with LMTPA; Sat, 19 Apr 2025 22:08:59 +0200 X-Cyrus-Session-Id : cyrus-123417-1745093339-1-2338322853409931678 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1745093339; cv=none; b=XKWZv3xDFX6wWtppB8i/KMIhnzlW/lGYbXC877rX5WbG8m+sjaKRvUXf7lZaAthZ+H7v+UteEnH BMFJfjYNgThrDMtjW1chh+hTAc+Ke/rxWnM9Gg+lHNccbZeXP9tL8Is61Sm1S3Onj/bZ8nGPHdLV j/2GtTtKj3ZqczVQCzou9g1r+eZAJ2LQLlRUJqN0m3ziezfgv7XTkEQIioHRGx+zM1uK0JBihUDI TwbrDlYuJxGvwfBsOFmcWfXkIgqUivC67wkxKhK/daKQlLekazyYctcdt+P9uvjq3S1NQt9x7uBb 393yiasn5OE2v4AjT7FY3uyv7zuerVJzulKBlBg== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1745093339; h=DKIM-Signature:DKIM-Signature:From:To:Date:Subject; bh=Bcp1WxKaXN103FPNDJvs0j6OeQ7ANMut89g0Zdq8RKI=; b=Dn2ymprzV6Ub+dBH5pTZ8LY1mc w4X6BcV9mByI9rDsQBNWat3xAzSFPLjO0kyucIXzCCd8V41CMNRu6yQQJEoSNGT6kjClMmhRt04p AsEmGe69pdZcO2CzkkMzXRN+6weZ9ealQOj63Gg9nnhCCHeuZ2I5e7M+wm8oimcJ9Jhp61VlWrjT q2mjBYHKGixsaMGxOKztPP2zLNGKQF8ko1I1XHPhrzP3Htlqf5p8qqfEfMPyNQ9JkPpKhbvJrj2T 0kXKZ5teuwWIBmeOe6ITJUPX8vD4T6NrPd23KkolpRaL0vokJoNbcQRY0XBvLOwI0OXjnOfJjUrK 6APBGW0xxLKw== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=e246-11.smtp-out.eu-west-3.amazonses.com smtp.mailfrom=011301964fab26ca-0d6241d5-27a9-4395-928d-7f232cbda4a0-000000@eu-west-3.amazonses.com; dkim=pass reason="good signature" header.b=Zmts1p header.d=wavveststg.com header.s=cr2q4spx5wfkwlbd7pv2aq3q75ps4izi; dkim=pass reason="good signature" header.b=AV6W8H header.d=amazonses.com header.s=j63x6gf2jjdvyisfatb6v77wqrk35cj4; dmarc=pass reason="SPF is not aligned, DKIM is aligned"; arc=none smtp.remote-ip=23.251.246.11; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.9.1","queueID":"4Zg2lH1x2gz7t7f","contextId": "350187dc-ec70-4616-acc3-4d5f0a22845b"} X-ppbforward : {"queueID":"4Zg2lH1x2gz7t7f","server":"mlpnf0103"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0103.laposte.net (SMTP Server) with ESMTP id 4Zg2lH1x2gz7t7f for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Sat, 19 Apr 2025 22:08:59 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4Zg2lH0WZjz7t7Z","contextId": "df869116-8a54-401d-a347-4bbc5e5a04e6"} X-lpn-mailing : LEGIT X-lpn-spamrating : 40 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=011301964fab26ca-0d6241d5-27a9-4395-928d-7f232cbda4a0-000000@eu-west-3.amazonses.com smtp.helo=e246-11.smtp-out.eu-west-3.amazonses.com; dkim=pass reason="good signature" header.d=wavveststg.com header.s=cr2q4spx5wfkwlbd7pv2aq3q75ps4izi header.b=Zmts1p; dkim=pass reason="good signature" header.d=amazonses.com header.s=j63x6gf2jjdvyisfatb6v77wqrk35cj4 header.b=AV6W8H; dmarc=pass reason="SPF is not aligned, DKIM is aligned"; arc=none smtp.remote-ip=23.251.246.11; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (0)(0000)gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvfeehleeiucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucenucfjughrpegghffvfffutgfgkfeshhgsredttddtjeenucfhrhhomheptfgvlhgrhicumhhonhguihgrlhcuhfftuceonhhorhgvphhlhiesfigrvhhvvghsthhsthhgrdgtohhmqeenucggtffrrghtthgvrhhnpeeutdeukeehlefhvefhgefhueekgefhuddvfefggfelvedtgedvfeetvdeugedvleenucffohhmrghinhepmhhonhguihgrlhhrvghlrgihrdhfrhdpmhhrmhhonhguihgrlhhfrhhrvghlrdgtohhmpdhgohhoghhlvgdrtghomhdpmhhonhguihgrlhhrvghlrgihrdhmohgsihhlvgdprghpphhlvgdrtghomhdpfhgrtggvsghoohhkrdgtohhmpdhtihhkthhokhdrtghomhdpihhnshhtrghgrhgrmhdrtghomhdpthifihhtthgvrhdrtghomhdplhhinhhkvgguihhnrdgtohhmpdgrvhhishdqvhgvrhhifhhivghsrdgtohhmnecukfhppedvfedrvdehuddrvdegiedruddunecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvdefrddvhedurddvgeeirdduuddphhgvlhhopegvvdegiedquddurdhsmhhtphdqohhuthdrvghuqdifvghsthdqfedrrghmrgiiohhnshgvshdrtghomhdpmhgrihhlfhhrohhmpedtuddufedt udelieegfhgrsgdviegtrgdqtdguiedvgeduugehqddvjegrledqgeefleehqdelvdekugdqjehfvdefvdgtsggurgegrgdtqddttddttddttdesvghuqdifvghsthdqfedrrghmrgiiohhnshgvshdrtghomhdpnhgspghrtghpthhtohepuddprhgtphhtthhopegvlhgvrdhlvghmohhinhgvsehlrghpohhsthgvrdhnvghtpdhsphhfpehprghsshdpughkihhmpehprghsshdpughmrghrtgepphgrshhspdhrvghvkffrpegvvdegiedquddurdhsmhhtphdqohhuthdrvghuqdifvghsthdqfedrrghmrgiiohhnshgvshdrtghomhdpghgvohfkrfepfgfu Received : from e246-11.smtp-out.eu-west-3.amazonses.com (e246-11.smtp-out.eu-west-3.amazonses.com [23.251.246.11]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0103.laposte.net (SMTP Server) with ESMTPS id 4Zg2lH0WZjz7t7Z

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

This IP belongs to Cox Communications.

The IP attempted to use the FTP server to distribute data recovery tools.

The IP address has been linked to the creation of artificial traffic to crash our website.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

This IP belongs to General Electric.

It tried to execute dictionary attacks on our Mail service causing potential delays.

This IP belongs to Morgan Stanley.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

The IP attempted to use the FTP server to distribute data recovery tools.

This IP belongs to TJX.

The IP attempted to mark emails as read on the IMAP server without authorization.

It attempted to use the FTP server to distribute SQL injection tools.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

This IP belongs to America Movil.