Multiple requests to the server's robots.txt file.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

It initiated requests to non-existent endpoints.

The IP had been flagged for initiating SYN flood attacks on our servers.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! Recu Samedi 24 Mai 2025 après 21h43 (toujours envoyés les nuits, les week-ends, la veille au soir) 2ème mails escrocs usurpant DISNEY venant de l’adresse mail escroc JseKQc@propertygrip.com gérée par abuse-domains@cronon.net et utilisant des boites mails amazonses.com et adresse IP 69.169.224.12 gérée par email-abuse@amazon.com Received : from b224-12.smtp-out.eu-central-1.amazonses.com (b224-12.smtp-out.eu-central-1.amazonses.com [69.169.224.12]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0107.laposte.net (SMTP Server) with ESMTPS id 4b4XX14LPLz1qqjG JE N’AI RIEN chez DISNEY ! ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <0107019703d2a2ba-b5fec37c-2789-41cd-951b-1cff5c55741b-000000@eu-central-1.amazonses.com> Received : from mlpnf0107.laposte.net (mlpnf0107.sys.meshcore.net [10.94.128.86]) by mlpnb0108 with LMTPA; Sat, 24 May 2025 21:43:45 +0200 X-Cyrus-Session-Id : cyrus-1748115825-11048-2-10959869089190661845 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1748115825; cv=none; b=ppTRqtmP1y7Y7oM+Mtbj1ndg8DFr0V58Y+uhyDHmxH+k+EdEblWM91E4E7yePkuERU17WowXrtk x5KBgnuL7oHCumONd6DHMdFQ6EMX6dafOYo/RzTGfxuTzvtXC0iQ8o3hx2vsrqqLSzuJ7WaYNHHp u8RNKWnHUNHWrHJgwDNJNXKrVF7A7W07GcaMU+VdlMyN2gtNimav5TAIy6x1GBWfRF57YutAY3xg js104sunQZPqbCIVGjDg2u7MZAH00aLJrv5fiRRlO/minGOLjpGIAqyaieRUYVk/NcQaxCimQIN1 u4zQJQdhHLqYoQN04r6ONK9OFJJ9uUiJJLmVVFA== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1748115825; h=DKIM-Signature:DKIM-Signature:From:To:Subject:Date; bh=4CKU1uYOsv8IXG0lPrdm3lr0B7XjtgiGoyeDahvNpS0=; b=ZrIYHAWINjMt1CHGALeNU13Ryj sZ1CPiCH1byyMFUzcplVWicbcwYDuCa3JPmNWdrPdu1Lalvq8DjTURT5cUKskXpln4P00Z/GjPj1 FYZgsXedVRQ2nJfaJ/4cMCJY3upTrjTdwNLox5cu+36oZicS/VPvxUI53ZC15f1AqimApsY/nO+I yVf4xPjLVIRG5N4v6rOyJxOnNgOcsCRQSSeFFqj9+QSqMZF8uSt8dJvhEWPsQOLXCEq7wKz1O219 3BUrNKZhaqs+ek/W9GMMff228+qRKuaVQHppTe/AFIlM6knpeNLUEhUOTJsyqVEsaJBwMuLENQbi +CN6MkccUESw== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=b224-12.smtp-out.eu-central-1.amazonses.com smtp.mailfrom=0107019703d2a2ba-b5fec37c-2789-41cd-951b-1cff5c55741b-000000@eu-central-1.amazonses.com; dkim=pass reason="good signature" header.b=R/ye9Y header.d=propertygrip.com header.s=twvsrfbjmqllbek4cosvrhsuzetnmbe4; dkim=pass reason="good signature" header.b=cFOJF/ header.d=amazonses.com header.s=54ecsf3zk7z4mwxwwox7z7bg6e5gwjsz; dmarc=pass reason="SPF is not aligned, DKIM is aligned"; arc=none smtp.remote-ip=69.169.224.12; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.9.1","queueID":"4b4XX15576z1qqjD","contextId": "a56bde29-256c-4c75-b180-f0869bea7453"} X-ppbforward : {"queueID":"4b4XX15576z1qqjD","server":"mlpnf0107"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0107.laposte.net (SMTP Server) with ESMTP id 4b4XX15576z1qqjD for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Sat, 24 May 2025 21:43:45 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4b4XX14LPLz1qqjG","contextId": "aa0b942c-0aa2-4191-ac36-535f4f1d2064"} X-lpn-mailing : SPAM

This IP belongs to Home Depot.

The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

Unexpected changes in the server configuration or installed software.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

We identified the IP address as a source of numerous scare tactics spyware.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

It showed unusual patterns in the sequence of requests.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

This IP belongs to Liberty Mutual Insurance Group.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

The IP attempted to use the FTP server as a proxy for other malicious activities.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

This IP belongs to Microsoft Azure.

Multiple requests with the same X-Wap-Profile header.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

This IP belongs to DigitalOcean.

This IP belongs to Boeing.