The IP attempted to send spam emails from the Mail server.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

Reçu mail escroc Fausse prime carburant en usurpant le LOGO Impots.Gouv.fr Venant d’une adresse mail du Brésil : loja@useroots.com.br From : Aide Carburant 2024 <loja@useroots.com.br> Mais utilisant des boites mails Amazonses.com Et adresse IP : 54.240.48.111 Received : from a48-111.smtp-out.amazonses.com (a48-111.smtp-out.amazonses.com [54.240.48.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0116.laposte.net (SMTP Server) with ESMTPS id 4VG4zp3WRFz1GBw5 for <@laposte.net>; Fri, 12 Apr 2024 07:36:06 +0200 (CEST) DKIM-Signature : v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; ****************** Contenu du mail des escrocs ************** Attention phishing profiter de la prime • Aujourd'hui, à 07:36 (il y a 2 heures) 9Ko • • • A2 De : Aide Carburant 2024

Unusual patterns in session IDs.

This IP belongs to CVS Health.

This IP belongs to GoDaddy.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

GET /../htpasswd: Trying to access password files using directory traversal.

Attempts to access the server using unusual HTTP methods or request types.

Unusually high number of requests to a specific service or application within the server.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

It attempted to login to the POP3 server with an invalid password.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

It attempted to perform Command Injection attacks on the Apache server.

POST /upload.php: An attempt to upload a possibly malicious file.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

Attempts to access the server using stolen or leaked credentials.

This IP belongs to Sky Broadband.

udden increase in account lockouts due to multiple failed login attempts.

This IP belongs to Telkom SA.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

This IP belongs to MTS (Mobile TeleSystems).

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.