It attempted to perform a Sentinels amplification attack on the SSH server.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

It attempted to use the FTP server to distribute botnet command and control software.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

Multiple requests with the same Warning header.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

It attempted to perform a replay attack on the SASL server.

This IP belongs to Goldman Sachs Group.

The IP attempted to perform a password spraying attack on the SSH server.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

The IP attempted to brute force the password to gain mail account access.

Multiple requests to the server's robots.txt file.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Recu Mardi 27 Mai 2025 après 15h36 ( envoyés aussi les nuits, les week-ends, la veille au soir) 9 èmes mails escrocs usurpant MONDIAL RELAY venant de l’adresse mail escroc IjKXgH@compliancebox.com.br gérée par cert@cert.br et mail-abuse@cert.br et utilisant encore des boites mails amazonses.com et adresse IP 54.240.48.111 gérée par email-abuse@amazon.com Received : from a48-111.smtp-out.amazonses.com (a48-111.smtp-out.amazonses.com [54.240.48.111]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0118.laposte.net (SMTP Server) with ESMTPS id 4b6DDv0yJSz12LCX JE N’AI RIEN COMMANDé = mails escrocs. ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <0100019711f57dfb-2cacbf5f-e3d4-4893-8f7e-939887ae6d0e-000000@amazonses.com> Received : from mlpnf0118.laposte.net (mlpnf0118.sys.meshcore.net [10.94.128.97]) by mlpnb0108 with LMTPA; Tue, 27 May 2025 15:36:31 +0200 X-Cyrus-Session-Id : cyrus-1748352991-199539-1-13104765522450645164 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1748352991; cv=none; b=beGrNVx1j05p2K4rsI+Z33pXF2BbvGVzNtB8NwPNJSbfchKVofYEdcxB/7IuF4OJzE2Kt/n0AUf 7DBKPglr5lIgR2rVZTlu1Ybh3Lw0wbX5c5GpMxVDYuh35qEeAxptZ+Sjy3WmP3ohPt6Q+qLxTyU3 qP6WjN61MDsa5Uu0xv+Adn9VlttYPCdWZfJJ5CwCA2VDPtyFc8Cnszsy9WAztib2PvJ26dCCz7B0 C0xPMh6NJBMEEOG7/yxTe2dTRHr4J6ag/EG7HGhyhYIwcIF9mCRxFcd1yCLHk+4sgsQCT9xjeoJY A8Y58KcE5jMDEEmgGMRo8NhrhMUJGmmTGRkC1Sw== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1748352991; h=DKIM-Signature:From:To:Subject:Date; bh=D6lxEQXlE //ZgjaBpdVNCMGI2YXr0QJwmv5CXHlbsMQ=; b=U0/TuWhDd9MPRbWh3oetf/KIIZcDTFauV9tsm j2OkaAX3kA+tvc5FeBuriTOk0sKiT/pxIv1hT5CX83NB/0OLBLpe8vJ6rKhcGjb7IVnXA2+W0DDQ d89YMd+fxgcuXQOOAmWxyYtlZJFagYBVq4YcmxPD86uA76RhUF0fvXGCzYfKgHCXyWDL84fcFVKE 6+OM0e4dfnBwLbK5jbu7t+jxG2eYEJu4bF0LVzWId4tVgtIZYdzyeg9wRKS3550HXjLJb+kvMKS/ dwnBsjJqqx0NhjvbDT5dM/WmNEZjv6k+eBdNcUdhVCFXdAJeZrifjDSBP2nza+70vPW3o8zkT1l9 A== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=a48-111.smtp-out.amazonses.com smtp.mailfrom=0100019711f57dfb-2cacbf5f-e3d4-4893-8f7e-939887ae6d0e-000000@amazonses.com; dkim=pass reason="good signature" header.b=Ngm53S header.d=amazonses.com header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=54.240.48.111; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.9.1","queueID":"4b6DDv2Kx3z12LCp","contextId": "717a808a-fb72-400c-bd3f-772b013f5135"} X-ppbforward : {"queueID":"4b6DDv2Kx3z12LCp","server":"mlpnf0118"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0118.laposte.net (SMTP Server) with ESMTP id 4b6DDv2Kx3z12LCp for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 27 May 2025 15:36:31 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4b6DDv0yJSz12LCX","contextId": "7b4fcd2e-3cbf-49bf-a0ab-efa419946e23"} X-lpn-mailing : WHITELISTED X-lpn-spamrating : 0 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=0100019711f57dfb-2cacbf5f-e3d4-4893-8f7e-939887ae6d0e-000000@amazonses.com smtp.helo=a48-111.smtp-out.amazonses.com; dkim=pass reason="good signature" header.d=amazonses.com header.s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw header.b=Ngm53S; dmarc=fail reason="SPF is not aligned, DKIM is not aligned"; arc=none smtp.remote-ip=54.240.48.111; bimi=skipped reason="non-pass DMARC" Received : from a48-111.smtp-out.amazonses.com (a48-111.smtp-out.amazonses.com [54.240.48.111])

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

It attempted to perform a phishing attack using the IMAP server.

This IP belongs to Deutsche Telecom.