Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

This IP belongs to Steam.

It made multiple requests with the same Referer header.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

This IP belongs to TIAA.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

This IP belongs to JPMorgan Chase.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

The IP attempted to use the FTP server to distribute steganography tools.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Recu Jeudi 15 Mai 2025 après 20h18 (toujours envoyés les nuits, les week-ends, la veille au soir) 8 ème mail escroc usurpant MONDIAL RELAY venant de l’adresse mail escroc devops@carynhealth.com gérée par abuse@godaddy.com et utilisant encore des boites mails amazonses.com et adresse IP 23.251.226.6 gérée par email-abuse@amazon.com Received : from e226-6.smtp-out.us-east-2.amazonses.com (e226-6.smtp-out.us-east-2.amazonses.com [23.251.226.6]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0104.laposte.net (SMTP Server) with ESMTPS id 4Zyz432m2szqSGl IP Lookup Details: IP Information - 23.251.226.6 Host name: ip50-158-240-162.lv.lv.cox.net Country: United States Country Code: US Region: CA City: Los Angeles Latitude: 34.069 Longitude: -118.3502 JE N’AI RIEN COMMANDé = mails escrocs. ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <010f0196d34dbe7f-04994c4e-67a3-472e-a3fe-6e03760d2fc8-000000@us-east-2.amazonses.com> Received : from mlpnf0104.laposte.net (mlpnf0104.sys.meshcore.net [10.94.128.83]) by mlpnb0108 with LMTPA; Thu, 15 May 2025 20:18:43 +0200 X-Cyrus-Session-Id : cyrus-163176-1747333123-4-10182526855118769318 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1747333123; cv=none; b=tPD0TcFJPiR8mJ5or1m7WMCbmXaTquPB3iMWmNjB44RbIb0QTGmPll3GKHqex2wJYrBakduJOzV PRjbSKMdrawuiKsESigfkBhA73akBpGMWXrE/5rRdMw9iYDSBm405LnLNFA76/fzv3wNrk9sqp64 eQ5lWS6EQR6a2rL6t4NaL6R2+0E9v540PznA+MQhj/bx+Z1vuJKv9lsMu73srRrpxs69M4YyKp9I uaSEBHCKkfuni3+RQsvTGeOgP+yV+Ov6wfn/ux2N+kItwpYwqlOYINGkwuB0f8C2M6NSQFiJOj5Y sR51Yz+DlYxZdlxoJ9U2cP2iKvqk16ZCj0hhVrw== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1747333123; h=DKIM-Signature:Date:From:To:Subject; bh=ghZXxMcJl yKK7KAqmrc9wNagnTt+ZfXAnt+IkmrJrCY=; b=tDYLtcwMnT52GFm4L+Cl/uIGf5m97rmzMOedg FS5EMr9Yg1ZQ02darFQiMLXTndoC+VH3NPwq3+WQ2Efigj5pAKR53LLM9fs7OEIcbSOFWF4bHP/D 34Ctu3L7XusFfy14ZtPRKG3UUwjBjJ8HIAsEk5EUR+lJe9MSnwvMNAPuHgdPUDBL1a9JLHWJf38a Q0Xk+5neZHNx8iE3JihoR/XCcm0AGQ/AC2/bJ7DbrB01AME9lui7D/3iLj7t6pS+dt3dgtP0xBuW Wgb+GxVqlFLjku6y+WoCqpyhTQKXhOtDGbWMWZpdbmV5Mnk8XMLR0Hyh90N3UqyCiEkH90Hc2ijr A== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=e226-6.smtp-out.us-east-2.amazonses.com smtp.mailfrom=010f0196d34dbe7f-04994c4e-67a3-472e-a3fe-6e03760d2fc8-000000@us-east-2.amazonses.com; dkim=pass reason="good signature" header.b=3wr9st header.d=amazonses.com header.s=xplzuhjr4seloozmmorg6obznvt7ijlt; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=23.251.226.6; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.9.1","queueID":"4Zyz434sFszqSHD","contextId": "8eab8d66-2ac4-40b8-af4c-7df45d169a32"} X-ppbforward : {"queueID":"4Zyz434sFszqSHD","server":"mlpnf0104"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0104.laposte.net (SMTP Server) with ESMTP id 4Zyz434sFszqSHD

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

This IP has been marked as the origin of numerous SQL injection attacks.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

It attempted to perform Web Service attacks on the Apache server.

It made multiple requests from user agents claiming to be bots.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

The IP attempted to register as an Asterisk user with no password.

It attempted to use the FTP server to distribute encryption tools.

The IP attempted to perform a QOTD amplification attack on the SSH server.

It attempted to login to the Postfix server with an invalid password.