By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

This IP belongs to Amazon.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

Unusual patterns in user agent strings.

The IP address attempted to login to the IMAP server with an invalid username.

Unusual activity in the server's error logs.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

This IP belongs to Apple.

It made multiple requests with the same X-Forwarded-For header.

This IP belongs to OVH.

The IP attempted to delete files from the FTP server.

The IP attempted to send emails from the Postfix server without proper authentication.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

It engaged in a click fraud operation using our server’s communication channels.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

This IP belongs to Shopify.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! Recu Mardi 27 Mai 2025 après 15h34 mails escrocs usurpant CDISCOUNT venant de l’adresse mail escroc jhuxtelloitech@gmail.com gérée par abusecomplaints@markmonitor.com et utilisant des boites mails GOOGLE et adresse IP 209.85.221.68 gérée par abuse@google.com et abuse@gmail.com Received : from mail-wr1-f68.google.com (mail-wr1-f68.google.com [209.85.221.68]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0107.laposte.net (SMTP Server) with ESMTPS id 4b6DC036SYz1qqjD IP Lookup Details: IP Information - 209.85.221.68 Host name: mail-wr1-f68.google.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 JE N’AI RIEN chez CDISCOUNT ! ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <jhuxtelloitech@gmail.com> Received : from mlpnf0107.laposte.net (mlpnf0107.sys.meshcore.net [10.94.128.86]) by mlpnb0108 with LMTPA; Tue, 27 May 2025 15:34:52 +0200 X-Cyrus-Session-Id : cyrus-1748352892-199693-1-12207448231002501616 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1748352892; cv=none; b=bU9Xy99fTT7fA7SXBgcxMCno+lPLzm+9v8Uf88oyXyCwxw9L6YkVosT2IV3wxOtJgtjx5CDbWk1 muVFc+jGFP0AyeeIbmC2jj686s/a+AtW6hTlrUtP8B0Xoj66QrK7k7wposauVHOQdpM5QYoseqKy 5Wd4smuPQcvcJMhns8JjlUTK1bU6N12TMdR8nUThiPY0OgHOkLNvNdRskYLmjqp3HNz6GQsNR/8u MfX2QDrEmQ5lbdaskLocT2m1wnaoOko0CICLC09PeDHXjLQZRltLW8B+LTjqO/lpTq5j0Bc7yDB5 O2S34dT+p3PwUDtoiVS5GWuUh3yetGicOzQsdxg== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1748352892; h=DKIM-Signature:Date:From:To:Subject; bh=LRT/InFCu 8j/ZGua/ns+bWrxRF1Slo/Jg3BwCvtkcpA=; b=E+CPDwM9D60WV669QD2DdX0Cyn35KlFTge9IF xnIjOMPC4IJ7senfq0cgFLhu/lfNMqJ59VgZaTXpUAghnPm/Axu/i3raGE/QG7ZTtWQWFD1ue5Gy dgojMlhNC5m/f6jFDWcf2oPylcUFmFMI6nO46NCklgLrX1nOq6+lP5VL+RYedV/sYKraJ9/QYZlS ou6e3xbaA1zwsbbfCk7pDe+ev67N4WeJVjZdBwenbFf3kwIOQUKxTnFqbBK7rIDGug9kezZxM0nK

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

This IP belongs to Target.

The IP initiated dictionary attacks, hoping to guess the correct password combination.