Participated in malicious pranks by altering messages sent through the server.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

This IP belongs to Netflix.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

This IP was implicated in attempts to inject ransomware into our systems.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos LOGOS, serveurs IP et boites mails ! Recu 7ème mails escrocs usurpant CETELEM sur les Boites emails à La POSTE.net : Bonjour Webmasters de SIGNAL SPAM, de CETELEM, et LA POSTE.net, Ce Lundi 30 Juin 2025 après 13h38 (et souvent aussi envoyés les nuits, ou tôt les matinées, ou les week-ends, avant ou après les ouvertures des Bureaux et Administrations en France )( méthodes d’escrocs et de faux culs ) j'ai reçu ce 7 ème mails ci-dessous d’escroquerie usurpant CETELEM et venant cette fois-ci de l'adresse email d’escroquerie: lananorde@cyncsupport.gelighting.com gérée par domain.admin@ge.com L’adresse IP utilisée par ces batards de hackers fous est: 65.74.83.231 gérée par abuse@gci.net Received : from 231-83-74-65.gci.net (231-83-74-65.gci.net [65.74.83.231]) by mlpnf0113.laposte.net (SMTP Server) with ESMTP id 4bW40q15VjzYcnL; Mon, 30 Jun 2025 13:38:18 +0200 (CEST) Content-Type : multipart/mixed; boundary="===============5448760500630099117==" MIME-Version : 1.0 From : "GESTION-MAIL" <lananorde@cyncsupport.gelighting.com> To : contact@laposte.net Subject : (2025)CLIENTS©CETEL£M-Fr IP Lookup Details: IP Information - 65.74.83.231 Host name: 231-83-74-65.gci.net Country: United States Country Code: US Region: Alaska City: Kodiak Station Latitude: 57.6036 Longitude: -153.3751 utilisant ENCORE les adresses IP et serveurs mails de la Société GCI.net C'est clairement une tentative d’escroquerie usurpant CETELEM, je n’ai rien chez eux ! Ci-dessous cet email d’escroquerie avec ces en-têtes complets : *********************** Contenu du mail des hackers fous *********************** (2025)CLIENTS©CETEL£M-Fr • Aujourd'hui, à 13:38 (il y a 2 heures) 6Ko • • • G De : GESTION-MAIL • A : contact@laposte.net • Cher(e) Client(e) Vous avez une demande en attente dans votre espace Veuillez procéder à la confirmation ou annuler la demande avant qu’elle n’expire. Cliquez sur le bouton ci-dessous pour accéder : Nous vous remercions de votre confiance, Cordialement,

It sent SIP INVITE requests to non-existent extensions.

Several cross-site scripting attacks were traced back to this IP.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

It initiated multiple account lockouts in a short period.

The IP was noted for executing SYN flood attacks, purposefully creating half-open connections to deplete server resources.

The IP address attempted to exploit known vulnerabilities in server software.

This IP belongs to World Fuel Services.

This IP belongs to Anthem.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

This IP belongs to Target.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

High network traffic at unusual times, suggesting an automated process is running.