This IP belongs to Cardinal Health.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

The IP attempted to perform Stack Overflow attacks on the Apache server.

Login attempts that do not follow typical user behavior patterns.

GET /configuration.php.old: Trying to locate backup configuration files.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

The malicious IP was involved in a SPIT (Spam over IP Telephony) attack, sending unsolicited messages over the VoIP server.

It attempted to perform a password spraying attack on the POP3 server.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

The IP attempted to perform a distributed denial of service attack on the SSH server.

This IP belongs to JPMorgan Chase.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

GET /setup.php: Effort to locate setup files for PHP applications.

This IP belongs to Alphabet.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

Recu Lundi 22 Avril 2024 après 22h04 (envoyés toujours les nuits, ou les week-ends ) 4ème même mail escroc usurpant ENCORE SNCF Connect et venant de l’adresse mail bidon des hackers: info@livemint.com Et adresse IP 54.240.27.228 Utilisant encore des serveurs mails AMAZONSES.com Received : from a27-228.smtp-out.us-west-2.amazonses.com (a27-228.smtp-out.us-west-2.amazonses.com [54.240.27.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0105.laposte.net (SMTP Server) with ESMTPS id 4VNbms6D2xznTTg for <@laposte.net>; Mon, 22 Apr 2024 22:04:13 +0200 (CEST) DKIM-Signature : v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; et venant de l’adresse IP 54.240.27.228 aux U.S.A adresse IP encore gérée par: email-abuse@amazon.com IP Lookup Details: IP Information - 54.240.27.228 Host name: a27-228.smtp-out.us-west-2.amazonses.com Country: United States Country Code: US Region: WA City: Seattle Latitude: 47.5839 Longitude: -122.2995

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

It attempted to use the FTP server to distribute identity theft tools.

It launched a botnet to infiltrate our Apache-DDoS service.

This IP belongs to Rogers Cable.

The IP attempted to login to the SASL server with an invalid username.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

The IP attempted to perform a distributed denial of service attack on the SSH server.