POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

This IP belongs to Ubisoft.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! RECEPTION mails escrocs usurpant CARREFOUR BANQUE sur les Boites emails à LAPOSTE.net : Bonjour Webmasters de SIGNAL SPAM, de CARREFOUR BANQUE, et LA POSTE.net, Mercredi 18 Juin 2025 après 04h56 (toujours envoyés les nuits, ou tôt les matinées, les week-ends, ou avant les ouvertures ou après le fermetures des Bureaux et Administrations en France )( méthodes d’escrocs et de faux culs ) j'ai reçu sur ma boite email ce 2ème mails ci-dessous d’escroquerie usurpant CARREFOUR BANQUE et venant cette fois-ci de l'adresse email d’escroquerie: darelone@ge.com gérée par domain.admin@ge.com L’adresse IP utilisée par ces batards de hackers fous est: 97.170.6.37 gérée par abuse@verizon.com Received : from 37.sub-97-170-6.myvzw.com (37.sub-97-170-6.myvzw.com [97.170.6.37]) by mlpnf0113.laposte.net (SMTP Server) with ESMTP id 4bMT0h5q3XzYcmj; Wed, 18 Jun 2025 04:56:52 +0200 (CEST) Content-Type : multipart/mixed; boundary="===============6084754646114693339==" MIME-Version : 1.0 From : Gestion25 <darelone@ge.com> IP Lookup Details: IP Information - 97.170.6.37 Host name: 37.sub-97-170-6.myvzw.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 Utilisant les adresses IP et adresses emails de la Société myvzw.com C'est clairement une tentative d’escroquerie usurpant CARREFOUR BANQUE, je n’ai rien chez eux ! Ci-dessous cet email d’escroquerie avec ces en-têtes complets : *********************** Contenu du mail des hackers fous *********************** macarte_ᴄᴀʀʀᴇꜰᴏᴜʀ25 • Aujourd'hui, à 04:56 (il y a 5 heures) 6Ko • • • G De : Gestion25 • A : contact@laposte.net • Cher(e) Client(e) Nous vous remercions de bien vouloir mettre à jour vos informations personnelles,ainsi que votre carte C-PASS. Faute de quoi votre contrat sera temporainement suspendu.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

Multiple requests with the same Proxy-Authorization header.

POST /db/images/: Attempt to post or insert a malicious file in the images directory of a database.

GET /configuration.php.old: Trying to locate backup configuration files.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

Conducted various IP scans, seeking loopholes in our network's security.

This IP belongs to Shaw Communications.

The IP attempted to delete files from the FTP server.

This IP belongs to Anthem.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

It attempted to perform a SIPVicious scan on the Asterisk server.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

It attempted to send emails from the Mail server that violate the server's email content policy.

It attempted to use the SASL server to distribute malware.

This IP belongs to Bristol-Myers Squibb.

This IP belongs to World Fuel Services.

This IP belongs to Virgin Media.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.