FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Reçu 13 ème mails usurpant la SOCIETE GENERALE avec serveurs IP et boites mails usurpées amicalmaoersan@reussiteativevieseus.com L’adresse IP du serveur utilisé par ces hackers fous est 188.165.52.203 gérée par abuse@ovh.net Et celà continue toujours Fin Juin 2025, depuis Mars 2017 ! comme toutes les années 2016, 2015, 2014, 2013 et 2012, etc ! Vendredi 20 Juin 2025 après 06h04 (envoyés toujours les nuits, tôt les matinées, avant ou après les ouvertures de Bureaux et Administrations en France, méthodes d’escrocs et de faux-culs) j'ai reçu sur ma boite mails ce 13 ème mails ci-dessous d’escroquerie Bancaire avec faux contenu SOCIETE GENERALE et venant de l'adresse mail bidon ou usurpée: amicalmaoersan@reussiteativevieseus.com gérée par abuse@ovh.net L’adresse IP du serveur utilisé par ces hackers fous est 188.165.52.203 gérée par abuse@ovh.net Received : from 3.mo576.mail-out.ovh.net (3.mo576.mail-out.ovh.net [188.165.52.203]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by mlpnf0120.laposte.net (SMTP Server) with ESMTPS id 4bNkPJ423SznTVJ for <@laposte.net>; Fri, 20 Jun 2025 06:04:04 +0200 (CEST) Received : from director8.ghost.mail-out.ovh.net (unknown [10.110.58.50]) by mo576.mail-out.ovh.net (Postfix) with ESMTP id 4bNkPJ2YjSz2wk8 for <@laposte.net>; Fri, 20 Jun 2025 04:04:04 +0000 (UTC) Received : from ghost-submission-5b5ff79f4f-p54fw (unknown [10.110.118.183]) by director8.ghost.mail-out.ovh.net (Postfix) with ESMTPS id 7E65AC02A9 for <@laposte.net>; Fri, 20 Jun 2025 04:04:03 +0000 (UTC) Received : from reussiteativevieseus.com ([37.59.142.102]) by ghost-submission-5b5ff79f4f-p54fw with ESMTPSA id ctK7N7LdVGib/wIAHh6ltQ (envelope-from <amicalmaoersan@reussiteativevieseus.com>) IP Lookup Details: IP Information - 188.165.52.203 Host name: 3.mo576.mail-out.ovh.net Country: France Country Code: FR Region: Paris City: Paris Latitude: 48.8323 Longitude: 2.4075 C'est visiblement et clairement une tentative d’escroquerie ! Je ne suis pas prêt d’avoir un Compte à la SOCIETE GENERALE, ni de gérer mes comptes par Internet ! Ci-dessous cet email de phishing avec ces en-têtes : *********************** Ci-dessous CODES HTML des hackers **************************************** Return-Path : <amicalmaoersan@reussiteativevieseus.com> Received : from mlpnf0120.laposte.net (mlpnf0120.sys.meshcore.net [10.94.128.99]) by mlpnb0108 with LMTPA; Fri, 20 Jun 2025 06:04:04 +0200 X-Cyrus-Session-Id : cyrus-1750392244-240008-1-3929716005523222991 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1750392244; cv=none; b=Rq7GA2pis64GkuZ0TozBvdbO9FyTKlASm+ThD5Q5tS7PnbXWVkrP3Eafh7pVN3TzbE6LRZIFs8P jdXSRKUetazUDt5H7+dqQva+G+CTdV6G/NCi6Jp1YySYUpAMPYOwViUZmGFdomifaCMt+0trdUh8 D6ytVfrt/mVfZ76kimZatZ4CvVXC9LGviEE4/+JU/SKDVZOoXBCeM7HikYHgkUtJ9NczXB6p7W9L TBb+n1kmbJOvW4r73cQDeYnApTSNHYDIUKpfKog6O6F6OjvRsMROWRAcge1DeBHiH0r9+05ORPIj

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

It attempted to login to the IMAP server with an invalid password.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

This IP belongs to Bank of America.

GET /backup.sql: Attempting to access a backup of your database.

It attempted to make unauthorized calls using the SIP server.

It was discovered illicitly scanning the server for potential vulnerabilities.

This IP belongs to DuPont de Nemours.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

The IP attempted to perform a password spraying attack on the SASL server.

This IP was traced back to several attempts to access domain admin credentials.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

The IP attempted to perform a dictionary attack on the POP3 server.

It attempted to exploit known vulnerabilities in the Postfix software.

Our system blocked an attempted Code Injection attack from this IP.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

This IP belongs to Citigroup.

It attempted to send emails from the Postfix server that violate the server's usage policy.