The IP attempted to use the FTP server to distribute anonymizing tools.

An alarming frequency of microphone loggers has been traced back to this IP.

This IP belongs to TJX.

The IP was seen attempting a FTP Smurf attack, flooding the FTP server with echo request packets to cause a denial of service.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

It attempted multiple LDAP injection attacks to gain unauthorized access.

The IP attempted to send emails from the Mail server without proper authentication.

This IP belongs to Microsoft.

The IP address attempted to register as a SIP user with an invalid username.

It attempted to perform a SYN flood attack on the SSH server.

This IP belongs to SingTel.

This IP belongs to Walmart.

The IP attempted to perform a SNMP amplification attack on the SSH server.

This IP was traced back to several attempts to access domain admin credentials.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour Services Sécurité FDJ ! Recu Dimanche 13 Juillet 2025 après 13h47 5ème mail escroc ( pseudo gain EURO DREAMS ) usurpant les LOGOS de la FRANCAISE des JEUX et venant de l’adresse mail escroc,usurpée, des hackers: kjackson@lobopg.com gérée par abuse@godaddy.com et venant de l’adresse IP 40.107.243.112 gérée par abuse@microsoft.com Received : from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on2112.outbound.protection.outlook.com [40.107.243.112]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4bg3bh2h1Bz1xn8; Sun, 13 Jul 2025 13:47:44 +0200 (CEST) ARC-Seal : i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; ************************* Codes HTML des hackers ********************* Return-Path : <kjackson@lobopg.com> Received : from mlpnf0109.laposte.net (mlpnf0109.sys.meshcore.net [10.94.128.88]) by mlpnb0108 with LMTPA; Sun, 13 Jul 2025 13:47:46 +0200 X-Cyrus-Session-Id : cyrus-1752407266-161012-1-15824963217167826193 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=2; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1752407266; cv=pass; b=J9WQwtlT4EJZBMGGvzwITt09x8nnav25t1boPpGkvbZw2q8AZn+7fspbtQcQ1GNuxC8Xf2RKt2j lMokspEXtDVPE/nF9gJsKlrn3RHwpxpS+rX7BANKnm/2lzkS5czksFNBph+nJjBKktXmw1xzoBlh r+tAOFF1Razmd9hWdCcWAGSnnwXbIF0zopKuOwbCzPygqO5e3VzSTsgJBY+R+LvICXZPkS/Zy8oe b0QeHRJLZHtHvkHUjlVr2Z0UXroThnyRKwR+hZ/I7O+4JJCz/Q5QGpfRh77REGrOsAUeuTLdoNYx Battd+kmaiT2sDOn0ClmYcoOLhqZia97zD4BthQ== ARC-Message-Signature : i=2; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1752407266; h=From:To:Subject:Date:References:In-Reply-To; bh=U LO8zqqtL3Wl0xVUtKJgvyVRdV1gX8gCHkrmqBqsf7Y=; b=MfYGCFODjCLJCSEreAJHWkFKUoiiE fULG73sdT6lSBy7rfH8Go2PhrjSMMX3spBSeys2YvUmUp95jQxd/IlvcROKZv7yBfzqgh/NVjm76 AsGkE3Y7hfBdZpT+1GyaCaE2XH6J8vmZ04F8MN87joMVsXHz2XlrVrJ83E8ppTVVe1LH4dkTTGtc z9m4EFncFNDshcDzaVSX+85K+T85iz7nnGPf33NL//VKnwX13mBoSBAleIwK7it0W73EUg6KvhMB LwTkZHNN8g63Z3fqimGgfBi5im/Jh735NsSvNT8/BXxdsLcdTHHHw9i5+k6Ilkw9xdQ+HzOFxAmT ts3qm+OxA== ARC-Authentication-Results : i=2; laposte.net; spf=pass smtp.helo=NAM12-DM6-obe.outbound.protection.outlook.com smtp.mailfrom=kjackson@lobopg.com; dkim=none; dmarc=none reason="No policy found"; arc=pass header.oldest-pass=0 smtp.remote-ip=40.107.243.112; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.9.1","queueID":"4bg3bj2wHmz1xn3","contextId": "8283dd5e-0da9-44be-b973-947d9d6b2264"} X-ppbforward : {"queueID":"4bg3bj2wHmz1xn3","server":"mlpnf0109"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0109.laposte.net (SMTP Server) with ESMTP id 4bg3bj2wHmz1xn3; Sun, 13 Jul 2025 13:47:45 +0200 (CEST) X-mail-filterd : {"version":"1.9.1","queueID":"4bg3bh2h1Bz1xn8","contextId": "f64a23b8-c740-40c0-ac19-e182a2d8c2ca"} X-lpn-mailing : LEGIT X-lpn-spamrating : 43 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=kjackson@lobopg.com smtp.helo=NAM12-DM6-obe.outbound.protection.outlook.com; dkim=none; dmarc=none reason="No policy found"; arc=pass smtp.remote-ip=40.107.243.112 header.oldest-pass=0;

Multiple requests with the same Origin header.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

Unusual system or application errors related to authentication or access controls.

GET /server-status: Often an attempt to check Apache server status.

Multiple requests with the same X-Csrf-Token header.

POST /upload.php: An attempt to upload a possibly malicious file.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

This IP belongs to Nexon.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.