Unusually high number of requests to a specific service or application within the server.

FOR YOUR INFORMATIONS and ACTIONS against these basterds HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, comptes et boites mails ! Recu Mercredi 28 Mai 2025 après 10h 10ème mails escroc usurpant encore SNCF CONNECT et venant de l’adresse mail escroc : noreply@moneyball.tech.zedia.com.br Et adresse IP 54.240.48.95 gérée par email-abuse@amazon.com utilisant encore des serveurs mails AMAZONSES.com Received : from a48-95.smtp-out.amazonses.com (a48-95.smtp-out.amazonses.com [54.240.48.95]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4b6hkQ4XGbz1xnH IP Lookup Details: IP Information - 54.240.48.95 Host name: a48-95.smtp-out.amazonses.com Country: United States Country Code: US Region: WA City: Seattle Latitude: 47.5839 Longitude: -122.2995 ************************* Codes HTML des hackers ********************* Return-Path : <0100019715e7fb50-54e31b51-f094-4a84-bd29-9b5bd35b3d8f-000000@amazonses.com> Received : from mlpnf0109.laposte.net (mlpnf0109.sys.meshcore.net [10.94.128.88]) by mlpnb0108 with LMTPA; Wed, 28 May 2025 10:00:15 +0200 X-Cyrus-Session-Id : cyrus-1748419215-202296-1-10702489836098807267 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1748419215; cv=none; b=FiOlLtBw/edQFDoMsGPHA7R8NivuGz295Fc4OZjwgiVFkPZHcWJbjNCY3CEywhXvGiSRYZaj67W ltHMTPdlKDcotA/THTLn2FzmKUAhhfEEbfS5d8M6flw4X5FbemnW+Qu5PjO4/KSN65pu8UawzqT3 kXnO0rL6YvBJrAQRuqBTQ2HCwkRZtOxLl4Hy6xToBhDJuGE3mP3Wx+PNoFtYQGGx3HYKHnIrBFGo ZoVmZ8UDXmCxTC+pNpQVVGy1lIhI0TWd/naeW7p91fnnQmWbeyyNa1WjzsYVBXSCswQ0vbf3uL3O RWzjHkh3iNCFvRd1pb3V60VMKZa1QxBvRtVwtjQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1748419215; h=DKIM-Signature:DKIM-Signature:From:To:Subject:Date; bh=J2EmURnrY0h6QVusVHiWF5sk8k6A8JhtvgEKia8euQY=;

This IP belongs to Wells Fargo.

This IP belongs to Travelers Cos.

It attempted to perform a phishing attack using the IMAP server.

The IP attempted to use the FTP server to distribute VPN tools.

This IP belongs to GoDaddy.

This IP belongs to Nintendo.

This IP belongs to Dow Chemical.

Participated in a botnet attack to overwhelm our server’s resources.

It attempted to perform a SIP Register Flood on the Asterisk server.

Login attempts that do not follow typical user behavior patterns.

The IP address attempted to login to the IMAP server with an invalid username.

It made multiple requests with the same If-None-Match header.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

The IP attempted to perform a credential stuffing attack on the IMAP server.

This IP belongs to Telefonica Spain.

The IP attempted to tamper with our Ad network, conducting fraudulent activities.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

This IP belongs to Cardinal Health.

Multiple requests with the same X-Csrf-Token header.

The malicious IP tried to depreciate the reputation of our mail server by sending out numerous spam mails.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

This IP belongs to Heroku.