The IP made multiple requests with the same Proxy-Authorization header.

This IP belongs to DuPont de Nemours.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! Recu Vendredi 02 Mai 2025 après 01h17 ( toujours envoyés les nuits, les week-ends, la veille au soir) 6 ème mail escroc usurpant MONDIAL RELAY venant de l’adresse mail escroc hello@graampay.com utilisant encore des boites mails amazonses.com et adresse IP 54.240.7.11 gérée par email-abuse@amazon.com Received : from a7-11.smtp-out.eu-west-1.amazonses.com (a7-11.smtp-out.eu-west-1.amazonses.com [54.240.7.11]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0105.laposte.net (SMTP Server) with ESMTPS id 4ZpVLl3y1QznTTy IP Lookup Details: IP Information - 54.240.7.11 Host name: a7-11.smtp-out.eu-west-1.amazonses.com Country: United States Country Code: US Region: WA City: Seattle Latitude: 47.5839 Longitude: -122.2995 JE N’AI RIEN COMMANDé = mails escrocs. ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <010201968e23a575-0bec30b4-1e49-4654-9a9f-4a3fb30e8e3d-000000@eu-west-1.amazonses.com> Received : from mlpnf0105.laposte.net (mlpnf0105.sys.meshcore.net [10.94.128.84]) by mlpnb0108 with LMTPA; Fri, 02 May 2025 01:17:03 +0200 X-Cyrus-Session-Id : cyrus-127775-1746141423-1-14042169139175666556 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1746141423; cv=none; b=Lt8/lnW27aLkAehseX/Qe/ZnJcxB2p3tjstsgeL4PZijsA+OzE43yATwsB9OwBdvlzpFvBg+gng 82vtFOUc4hm/RER2CZEVcZaQ2Uqdsg6s72E4uEjiYclH0syYLro639BbZwBQLT7XK99O/TYV/V23 u9M0CD4OWMSi8CZm01Yy4cDQ92/LGCLCl82wy8eyGJJ0LfCmYjMvEmF3pgvI3UDMeKc4oKipWKFh uORfLLXwHdFCskSPAf2uQNi/Z/nS59FkA0B/WgACYKwpwWoRwFkXeO9imTXF7B+DKqT6r1qreXP/ OmNxjJhb9SKbuToNM9F/dTX8SAZFi75I8N8G8pA== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1746141423; h=DKIM-Signature:From:To:Subject:List-Unsubscribe:Date; bh=4ZxzyINgWLoemmsXGm5gkoV6/YsbD8GgDpctQ4eJBr8=; b=cVL7vMCQFeMofYXB1FIn2HlzaX t7VStn1gGVn79/9MGELVBF3kI/4x6acpUIzU+TNHY1aUNFpxUkyEaEDMo5uM5I7GvEHrNi5tdz7W /dwMxfmvsJSfkA7a80XFMZxvCZsaX2hcrWKM9j+3m4WQQIPa8yVaLroXbJkusCoGHrjjsDFoQfom lIMp6AsC9o6RTqATijrl4RUJWpmbM4tw21qKGB3hcdEX6EQn+0EbVQIhiP6O1sa7CNlKI8FilzFm

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

The IP attempted to register as a SIP user with no password.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

It was involved in a Distributed Denial of Service (DDoS) attack.

This IP belongs to Medium.

Our team flagged this IP for injecting harmful ActiveX codes.

It made multiple requests with the same X-Requested-With header.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

This IP belongs to the University of California, Berkeley.

The IP attempted to send spam emails from the Mail server.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

This IP was caught distributing malicious APK files.

This IP belongs to Microsoft.

This IP belongs to Ziggo.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

This IP belongs to American Express.

This IP belongs to CVS Health.

It partook in location spoofing, making it appear from different locations.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.