This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

The IP attempted to send malware-infected attachments from the Mail server.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

This IP belongs to UnitedHealth Group.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

This IP belongs to Lowe's.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Recu Samedi 10 Mai 2025 après 03h28 (toujours envoyés les nuits, les week-ends, la veille au soir) 7 ème mail escroc usurpant MONDIAL RELAY venant de l’adresse mail escroc naresh@agilecrm.com gérée par abuse@moniker.com et utilisant encore des boites mails amazonses.com et adresse IP 54.240.8.26 gérée par email-abuse@amazon.com Received : from a8-26.smtp-out.amazonses.com (a8-26.smtp-out.amazonses.com [54.240.8.26]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0110.laposte.net (SMTP Server) with ESMTPS id 4ZvSvC2jvfz1nrw4 JE N’AI RIEN COMMANDé = mails escrocs. ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <01000196b7c645d5-a1965bf8-7cec-4493-8674-6e0d9736f4fe-000000@amazonses.com> Received : from mlpnf0110.laposte.net (mlpnf0110.sys.meshcore.net [10.94.128.89]) by mlpnb0108 with LMTPA; Sat, 10 May 2025 03:28:55 +0200 X-Cyrus-Session-Id : cyrus-205896-1746840535-1-2034124780753908799 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1746840535; cv=none; b=LxNyMYVKTYXU3Ji0bJtjHKt2a6KJnyQMV4wDJawGqiubjOFDo2Z8PnaQk6TvpEyGH4RkOTRlhP4 6mVlHD75JDXEv9zreAD+ANT69R+U7fKaOs4F91QPWg3cb6Ckm3idAt2M3TDcCHjDmc3jx3C6gwEq XfnM4f109PtIkrkTU3meeIp2OqnnEXnWFzD/QADn97nOwprwnDTt8IQBJtptCxY/fiYDCxZWdeg3 U/4TmZ+PS6/i3w/ntZG9DbqePD6Fu/+oVHdHY89Zl1pFjDlvVZ/7osaqZhZYThl+VhKUPXi1ZtR2 48YY0Xou4M3mD4747OJ47lZnCgppeT4actgNukw== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1746840535; h=DKIM-Signature:From:To:Subject:List-Unsubscribe:Date; bh=x9PDLE4MLn6DdlvvyVKuahyLaF6mqQzAyhyYS8fH6W4=; b=QJ7rI99RZPAfeJPuPwMk3vqdQz TWJaNCkBo5CLzgOoWyUFJnthdFF0ZpGvt1V7hLqOhQt4MIUEK2HLllrkfz/efTMUNDQeXurPfpUV tSIB6Nb9RDkPyf+qYw1pqij9cogogKj8vNY2/KuR4wk9tqhzKfcRgtVbM7XTD0lS/mgK/KtBAL+n 7jX9pFxaPpCkoRRFWPJ1yWMTVoBeiTOgoTMH3/Pr/azrcgSm5/ldCxYlqxWMuOptWUcHaKyEzLAv mouWJuISz2fDpeK4Q17yn4FGISEE4xJj5Rs5iPWpdqQmKHT4BDL3NokPYiCrv/5P9wSdpRUJFoXG rxN6LRoSNV7A== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=a8-26.smtp-out.amazonses.com smtp.mailfrom=01000196b7c645d5-a1965bf8-7cec-4493-8674-6e0d9736f4fe-000000@amazonses.com; dkim=pass reason="good signature" header.b=dnFdnk header.d=amazonses.com header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=54.240.8.26; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.9.1","queueID":"4ZvSvC4mjRz1nrwG","contextId": "450897e5-6d31-48d7-a499-3f3ff780f9c2"} X-ppbforward : {"queueID":"4ZvSvC4mjRz1nrwG","server":"mlpnf0110"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0110.laposte.net (SMTP Server) with ESMTP id 4ZvSvC4mjRz1nrwG for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Sat, 10 May 2025 03:28:55 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4ZvSvC2jvfz1nrw4","contextId": "99a79c29-1ed6-476e-bb19-4005b09887a5"} X-lpn-mailing : WHITELISTED X-lpn-spamrating : 0 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=01000196b7c645d5-a1965bf8-7cec-4493-8674-6e0d9736f4fe-000000@amazonses.com smtp.helo=a8-26.smtp-out.amazonses.com; dkim=pass reason="good signature" header.d=amazonses.com header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw header.b=dnFdnk; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=54.240.8.26; bimi=skipped reason="non-pass DMARC" Received : from a8-26.smtp-out.amazonses.com (a8-26.smtp-out.amazonses.com [54.240.8.26]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0110.laposte.net (SMTP Server) with ESMTPS id 4ZvSvC2jvfz1nrw4

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

This IP was caught circulating email worms, camouflaged as legitimate mails.

Multiple requests with identical POST parameters.

This IP belongs to the United States Department of Defense.

The IP made multiple requests to the server's robots.txt file.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

This IP attempted to distribute malicious Javascript files.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

This IP belongs to Comcast.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

The IP attempted to perform a dictionary attack on the POP3 server.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

It attempted to use the FTP server to distribute web proxy tools.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.