Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Pour Service SECURITE du CREDIT MUTUEL : Recu Dimanche 31 Aout 2025 après 17h29 12 èmes mails escrocs usurpant CREDIT MUTUEL venant de l’adresse mail escroc ou usurpée: geramosmamrr@zoranboutiquebleu.com gérée par abuse@ovh.net en utilisant des boites mails OVH.net et adresses IP 188.165.48.182 et 37.59.142.113 aussi gérées par abuse@ovh.net Received : from 7.mo560.mail-out.ovh.net (7.mo560.mail-out.ovh.net [188.165.48.182]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by mlpnf0113.laposte.net (SMTP Server) with ESMTPS id 4cFGBv4n9jzYcmc for <@laposte.net>; Sun, 31 Aug 2025 17:29:27 +0200 (CEST) Received : from director3.ghost.mail-out.ovh.net (unknown [10.110.54.124]) by mo560.mail-out.ovh.net (Postfix) with ESMTP id 4cFGBv2kfyzBB4B for <@laposte.net>; Sun, 31 Aug 2025 15:29:27 +0000 (UTC) Received : from ghost-submission-5b5ff79f4f-6wq4r (unknown [10.108.42.201]) by director3.ghost.mail-out.ovh.net (Postfix) with ESMTPS id DDCFFC04E4 for <@laposte.net>; Sun, 31 Aug 2025 15:29:26 +0000 (UTC) Received : from zoranboutiquebleu.com ([37.59.142.113]) by ghost-submission-5b5ff79f4f-6wq4r with ESMTPSA id ItyLH1ZqtGggexUAC3WkIQ (envelope-from <geramosmamrr@zoranboutiquebleu.com>) C'est visiblement et clairement une tentative d’escroquerie ! Ci-dessous cet email de phishing avec ces en-têtes complets : ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <geramosmamrr@zoranboutiquebleu.com> Received : from mlpnf0113.laposte.net (mlpnf0113.sys.meshcore.net [10.94.128.92]) by mlpnb0108 with LMTPA; Sun, 31 Aug 2025 17:29:27 +0200 X-Cyrus-Session-Id : cyrus-1756654167-218471-1-15236094740970335376 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1756654167; cv=none; b=FTvm7kob2oKaaR9GNctiESUFx/4vfTzQBr03a09cJpxO6UV8kzHx01eWDeVUfBwl1DRrWwIuRDU 6EyIdzLStUyx6VnpbrSm/i1CTCgKE8Y0RdLu+T05E6mj2kmufT1ReV6vMaMZVz6Gt3LF1k9xs5zB I/GRg8sP1zDg7mgWlrdhx6VSNXplhhTGv/8xa7lhkBVMvfFI+HhaQZ6k04aUqbLUC751fR7BKiBQ Vd+IV0UpOBxa1WlClgliqF6w7PtZ66awMrhrobq7kNyCdCDrfEh9Zj49FGNi6UikgirfLH2PzrHW xTxU3qk7T2GIMwes7MWOV1tTEzt1kzbtIcWzVQQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1756654167; h=From:To:Date:Subject:DKIM-Signature; bh=qYYmOjCHL BRxAttgjp4XfbfhbgnopJYTPBmZ2r7dmck=; b=R8Apjb7mVnC9Yr+pqzmj1xpudYsLLDqRLlSsK LPyNZA8FvX+aEs2SdXh2oz/e0ugMbXdTw/tEeM51hN7h//CACYJdJJ89hqcEW4MbrSF4bcQG0ra5 UHrSfXaXKRdpefnlavPHIskqZmExxEeqd3fJD6LN1RVCDeTYqq+0ISC8Q6fx6tRIsOJ+5/PoCd5a TJ6m2RdjC4XxrjBzhS6hUHYRWCcEvjvYOfDJRKlCd4nvdRd8S2A12AZ7c2avMZnMs13lBtdmeVTm VUqJXzsOHlfPzutgri6spPbdNccTWTq3E4VJYLpjBBZvZPOjyeXevk8fodgpQLnJD7WI7mR57I7I

Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, LOGOS, Comptes et boites mails ! FOR YOUR INFORMATIONS and ACTIONS against these Basterds HACKERS USING your servers IP and accounts and mails boxes ! Pour Service SECURITE du CREDIT MUTUEL : Recu Dimanche 31 Aout 2025 après 17h29 12 èmes mails escrocs usurpant CREDIT MUTUEL venant de l’adresse mail escroc ou usurpée: geramosmamrr@zoranboutiquebleu.com gérée par abuse@ovh.net en utilisant des boites mails OVH.net et adresses IP 188.165.48.182 et 37.59.142.113 aussi gérées par abuse@ovh.net Received : from 7.mo560.mail-out.ovh.net (7.mo560.mail-out.ovh.net [188.165.48.182]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by mlpnf0113.laposte.net (SMTP Server) with ESMTPS id 4cFGBv4n9jzYcmc for <@laposte.net>; Sun, 31 Aug 2025 17:29:27 +0200 (CEST) Received : from director3.ghost.mail-out.ovh.net (unknown [10.110.54.124]) by mo560.mail-out.ovh.net (Postfix) with ESMTP id 4cFGBv2kfyzBB4B for <@laposte.net>; Sun, 31 Aug 2025 15:29:27 +0000 (UTC) Received : from ghost-submission-5b5ff79f4f-6wq4r (unknown [10.108.42.201]) by director3.ghost.mail-out.ovh.net (Postfix) with ESMTPS id DDCFFC04E4 for <@laposte.net>; Sun, 31 Aug 2025 15:29:26 +0000 (UTC) Received : from zoranboutiquebleu.com ([37.59.142.113]) by ghost-submission-5b5ff79f4f-6wq4r with ESMTPSA id ItyLH1ZqtGggexUAC3WkIQ (envelope-from <geramosmamrr@zoranboutiquebleu.com>) C'est visiblement et clairement une tentative d’escroquerie ! Ci-dessous cet email de phishing avec ces en-têtes complets : ********************* Codes HTML des hackers ci-dessous *************** Return-Path : <geramosmamrr@zoranboutiquebleu.com> Received : from mlpnf0113.laposte.net (mlpnf0113.sys.meshcore.net [10.94.128.92]) by mlpnb0108 with LMTPA; Sun, 31 Aug 2025 17:29:27 +0200 X-Cyrus-Session-Id : cyrus-1756654167-218471-1-15236094740970335376 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1756654167; cv=none; b=FTvm7kob2oKaaR9GNctiESUFx/4vfTzQBr03a09cJpxO6UV8kzHx01eWDeVUfBwl1DRrWwIuRDU 6EyIdzLStUyx6VnpbrSm/i1CTCgKE8Y0RdLu+T05E6mj2kmufT1ReV6vMaMZVz6Gt3LF1k9xs5zB I/GRg8sP1zDg7mgWlrdhx6VSNXplhhTGv/8xa7lhkBVMvfFI+HhaQZ6k04aUqbLUC751fR7BKiBQ Vd+IV0UpOBxa1WlClgliqF6w7PtZ66awMrhrobq7kNyCdCDrfEh9Zj49FGNi6UikgirfLH2PzrHW xTxU3qk7T2GIMwes7MWOV1tTEzt1kzbtIcWzVQQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1756654167; h=From:To:Date:Subject:DKIM-Signature; bh=qYYmOjCHL

It was responsible for an unusual increase in server CPU usage.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It attempted to delete files from the SSH server.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

Several phishing emails have been traced back to this suspicious IP address.

Participated in a botnet attack to overwhelm our server’s resources.

This IP belongs to Marathon Petroleum.

There were several attempts from this IP to manipulate our server DNS records.

This IP belongs to Walgreens Boots Alliance.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

GET /configuration.php.old: Trying to locate backup configuration files.

The IP attempted to use the POP3 server to relay spam.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.