The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

The IP attempted to perform a timing attack on the SSH server.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

Numerous incidents of botnet infestations were traced back to this offensive IP address.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

The IP made multiple requests to the server's robots.txt file.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

It attempted to make unauthorized calls using the VOIP server.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

It attempted to change file permissions on the FTP server.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

This IP belongs to WordPress.com.

It initiated various replay attacks, attempting to disrupt the system by re-transmitting legitimate data verbatim.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

Repeated attempts to alter or delete log files to cover tracks.

The IP was caught trying to overload the server through a Distributed Denial of Service attack.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Recu 6ème mails escrocs usurpant CETELEM sur les Boites emails à La POSTE.net : Bonjour Webmasters de SIGNAL SPAM, de CETELEM, et LA POSTE.net, Ce Vendredi 27 Juin 2025 après 18h42 (et souvent aussi envoyés les nuits, ou tôt les matinées, ou les week-ends, avant ou après les ouvertures des Bureaux et Administrations en France )( méthodes d’escrocs et de faux culs ) j'ai reçu sur ma boite email ce 6 ème mails ci-dessous d’escroquerie usurpant CETELEM et venant cette fois-ci de l'adresse email d’escroquerie: apoilie@cyncsupport.gelighting.com gérée par domain.admin@ge.com L’adresse IP utilisée par ces batards de hackers fous est: 108.46.163.132 gérée par abuse@verizon.com Received : from pool-108-46-163-132.nycmny.fios.verizon.net (pool-108-46-163-132.nycmny.fios.verizon.net [108.46.163.132]) by mlpnf0118.laposte.net (SMTP Server) with ESMTP id 4bTLtq5rTsz12LCt; Fri, 27 Jun 2025 18:42:11 +0200 (CEST) Content-Type : multipart/mixed; boundary="===============2241765164665538702==" MIME-Version : 1.0 From : "INF0MAIL25" <apoilie@cyncsupport.gelighting.com> IP Lookup Details: IP Information - 108.46.163.132 Host name: pool-108-46-163-132.nycmny.fios.verizon.net Country: United States Country Code: US Region: New York City: Hartsdale Latitude: 41.0233 Longitude: -73.8087 utilisant ENCORE les adresses IP et serveurs mails de la Société Verizon.net C'est clairement une tentative d’escroquerie usurpant CETELEM, je n’ai rien chez eux ! Ci-dessous cet email d’escroquerie avec ces en-têtes complets : *********************** Contenu du mail des hackers fous *********************** CETEL£M Protocole D85 • vendredi 27 Juin, 18:42 (il y a 13 heures) 6Ko • • • I De : INF0MAIL25 • A : contact@laposte.net

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

The IP attempted to send emails from the IMAP server without authorization.