Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

We observed the IP distributing harmful document tracking tools.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

This IP belongs to UnitedHealth Group.

The IP attempted to execute unauthorized commands on the SSH server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

It attempted to exploit known vulnerabilities in the SASL protocol.

It attempted to exploit known vulnerabilities in the IMAP protocol.

Multiple requests with the same Proxy-Authorization header.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Bonjour Webmasters de AMENDES.GOUV.FR, Signal Spam, La Poste.net, Et celà continue encore et toujours en Mai 2025 ! Samedi 17 Mai 2025 après 02h20 (mails escrocs envoyés toujours les nuits, ou week-ends, avant ou après les horaires des Bureaux et Administrations en France, méthodes de faux-culs et d’escrocs ) j'ai reçu sur ma boite email ce 3ème mail escroc ci-dessous avec faux contenu AMENDES.GOUV.FR et venant de l'adresse email bidon: CPGvvT@ufspartnerhub.com utilisant encore des boites mails AMAZONSES.com . Les adresses IP du PC ou smartphone de ce(s) hacker(s) fou(s) en cause sont: 54.240.11.11 gérée par email-abuse@amazon.com Received : from a11-11.smtp-out.amazonses.com (a11-11.smtp-out.amazonses.com [54.240.11.11]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0114.laposte.net (SMTP Server) with ESMTPS id 4Zzl3M4B2dzjWvl IP Lookup Details: IP Information - 54.240.11.11 Host name: 44-210-204-255.crawl.amazonbot.amazon Country: United States Country Code: US Region: WA City: Seattle Latitude: 47.5839 Longitude: -122.2995 C'est visiblement et clairement une tentative de phishing et fraude ! Ci-dessous cet email d’escroquerie avec ces en-têtes complets : *********** Codes HTML des hackers ci-dessous ************************** Return-Path : <01000196db9d6138-1414f7ca-0f5b-4a87-a033-afa327e6cfa9-000000@amazonses.com> Received : from mlpnf0114.laposte.net (mlpnf0114.sys.meshcore.net [10.94.128.93]) by mlpnb0108 with LMTPA; Sat, 17 May 2025 02:20:47 +0200 X-Cyrus-Session-Id : cyrus-115744-1747441247-1-16199683505306350904 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1747441247; cv=none; b=koesdWjWA8meF6GtZAfNQhmoKNMGcfExm3d1OIgoKJhMzQi8MjxJ9xefrCik8/Z5LsjKgq0y1Ji 343ONVWjZ8o3OTbc7q8meOyr+EEXNgI83T0BS2U6cvYJ5iKoOfk6fw/qCG2RhRDBUIGJawDYld3I DXsxYdeqH5Sg3d1jZFXjoZjuau90wmsudRbSohWSevq+eZs8zJvAr8Ht7ezC4Jwx9Z4Nl/p7t42e H1ctuqWwQKie82lBDa3UH9pWpo+ohpBrqYdMFyOXVI+NTHdxIxR8r+wmnmC1mSzTsb3ODzTT9/Rp bak3Stcaq2A21nGvglvUB8GGBKfBOsjdjMJF11w== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1747441247; h=DKIM-Signature:DKIM-Signature:From:To:Subject:Date; bh=eC9Sj2M3Plh2qvgGPjHJXyM21AwHIpYeukpm9bXUMh4=;

This IP belongs to Korea Telecom.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

This IP has been observed spreading mobile malware, targeting our company application users.

It attempted to perform SQL injection attacks through the Apache server.

Our records indicate the IP spread multiple executable infector spyware causing system malfunction.

This IP has been identified as running a botnet targeting our server systems with ransomware.

POST /user/register: An attempt to register a new user or brute force the user registration form.

It attempted to use the FTP server to distribute encryption tools.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.