This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

RECU nouveaux mails d’escroqueries usurpant AMELI.fr en France sur les Boites emails à LAPOSTE.net avec adresse email émettrice bidon : philippe.lea61@miseplacesreativesorients.miseplacesdesaidesfamilliaux.click Bonjour Webmasters de LAPOSTE.net, et SIGNAL SPAM, Signal-Arnaques.com, Arnaques Internet.com, et abuse@laposte.net et alertespam@labanquepostale.fr et abuse@ripe.net et hostmaster@ripe.net et abuse@google.com et abuse@gmail.com et network-abuse@google.com et arin-contact@google.com et fraude-bretic@interieur.gouv.fr Et abuse@microsoft.com et secure@microsoft.com et msndcc@microsoft.com Et IOC@microsoft.com et iphostmaster@microsoft.com Et assurance-maladie@info.ameli.fr et support@info.ameli.fr Et support@phishing-initiative.com et contact@phishing-initiative.com Et presse.cnam@assurance-maladie.fr et comentreprises.drp.cnam@assurance-maladie.fr For your Informations and actions against these hackers using your servers and mails boxes ! Et search-apnic-not-arin@apnic.net et http://www.apnic.net/apnic-info/whois_search2/abuse-and-spamming and F.B.I. Services in U.S.A ( for Google ) in hidden copy for Adress IP in U.S.A ( https://complaint.ic3.gov/default.aspx ) Et celà continue toujours en Mai 2024 et ceci depuis au moins +17 années ( emails tous archivés complets avec tous leurs codes HTML depuis 2007 )( il y a forcément des complicités, du laxisme, des incompétents d’Etats et Services Administratifs chez des fournisseurs d’accès mails, depuis toutes ces +16 années que celà dure ! Ces escrocs ont vraiment la SUPER belle vie pour sévir en France ! Ce Jeudi 09 Mai 2024 après h ( mails escrocs envoyés très souvent les jours fériés, ou les week-ends, très souvent les nuits, avant ou après les horaires des Bureaux et Administrations en France, méthodes de faux-culs et d’escrocs ) j'ai encore reçu sur ma boite email ce même email d’escroqueries aux faux contenus AMELI et venant des adresses mails bidons ou usurpées,volées : @maestro.bounces.google.com Mais vraie adresse mail des hackers: From: philippe.lea61@miseplacesreativesorients.miseplacesdesaidesfamilliaux.click Les adresses IP utilisées par le PC de ce(s) batards de hackers fous, débiles, têtus, butés, et analphabètes ( incapables d’écrire correctement le Français ) et ces mails sont préparés, envoyés en différés qqs heures avant ( ici Mercredi soir 08 Mai à 19h44 pour ne pas être tracés par un logiciel Sniffer sur leurs adresses Mac de cartes réseaux, ou par des commandes Traceroute sur leurs adresses IP en direct ( bandes de poules mouillées, fumiers, trouillards ! ): 209.85.160.199 aux U.S.A Received : from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0118.laposte.net (SMTP Server) with ESMTPS id 4VZbv11H98z12LC8 for <@laposte.net>; Thu, 9 May 2024 04:44:13 +0200 (CEST) Received : by mail-qt1-f199.google.com with SMTP id d75a77b69052e-43df24dbdfdso5447091cf.1 for <@laposte.net>; Wed, 08 May 2024 19:44:13 -0700 (PDT) IP Lookup Details: IP Information - 209.85.160.199 Host name: mail-qt1-f199.google.com Country: United States Country Code: US Region: City: Latitude: 37.751 Longitude: -97.822 utilisant encore des boites mails GOOGLE.com C'est clairement une tentative de phishing et fraude ( fautes de grammaire multiples ) Ci-dessous cet email d’escroquerie avec ces en-têtes complets : Assurance A̷̤̤MELI [GPX] • Aujourd'hui, à 04:44 (il y a 7 heures) 35Ko • • • S De : Services

The IP attempted to delete files from the FTP server.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

An identity theft activity was linked back to this malicious IP.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

This IP belongs to The Walt Disney Company.

The malicious IP was involved in a SPIT (Spam over IP Telephony) attack, sending unsolicited messages over the VoIP server.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

We flagged down attempts from the IP to leak backdoor viruses into the system.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

This IP belongs to General Electric.

The IP address has been involved in distributing adware to our server systems.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

Recu 3ème mail en 1 semaine usurpant COFIDIS: Venant de l’adresse mail bidon : landryduchauvin6@gmail.com Et utilisant les adresses IP GOOGLE : 209.85.221.41 et Received : from TC-Cosmopsarus 154.68.5.127 Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk for <@laposte.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) Received : by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-34ddc9fe497so1913526f8f.3 for <@laposte.net>; Tue, 07 May 2024 08:59:59 -0700 (PDT) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; xxxxxxxxxxxxxxxx CODES HTML des hackers ******************** Return-Path : <landryduchauvin6@gmail.com> Received : from mlpnf0109.laposte.net (mlpnf0109.sys.meshcore.net [10.94.128.88]) by mlpnb0108 with LMTPA; Tue, 07 May 2024 17:59:59 +0200 X-Cyrus-Session-Id : cyrus-213589-1715097599-1-3670923478525053547 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1715097599; cv=none; b=Wra6pr6q2rKxsN+790PhS+rbW9dZ46z7qHMwpHOTUHLJ/acN5QWyCd+CKqXiJEuI89p5fcQQZRs 8G0ZswsQ+iquVO7h+0iBf8XLNSeoPmTCemmTOSsDZ+vFIBlyrPslApevVQBPvApfFR2rqxw+tziD kEZfJjsSBC/6b34AkW7sAZaUvPR2+e2UEQsjwZxk1GEOhcnXCeAmLvEom3r4onSuQzOHAmiEOYjP hdOEELWxzsXDUOUlrEA2ozT19MMbfG8C5kUgFKRP0s57Zz9avHYuCjAtmuOEZc8xBJ5c+5Z2T0h2 Bb7vN0W//5LjzC6eYCRKQfvGoZdHOh/xfFPsFiQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1715097599; h=DKIM-Signature:Date:From:To:Subject; bh=9ah4qL0ow iWE5Q/hjto07kY7vrGVQF5+HoKat+gehWY=; b=sHLVibS8whrZXEnyvzf0Tax3jWICPXWKZX2KN TM4x37lBIJpNK6nAGFfCMXiYdl1TJwO3ZmHFtmz7RLMH+pillyK94ebOKXvHa97MhAnNrMH7mafR DgWS77r6W++OT81W/6qJIyk4zHcm089SDMLruMlbznXoE99hOORsV+67kabL26VZoW+UhrJCFTzU U72MchGGm5prGeXIxv1g8NW8PgUbYRzH4S42lOjS7fXKKqH4FBPXz1JTqEFID6dQl0zoS+a4o+kJ /i+yiAQ9y3EhepQt/8tL2SziWScTlA1673HV6UU/gh50p//epf2wK9am9RW/S/U4GVt/uFfCWa6l g== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wr1-f41.google.com smtp.mailfrom=landryduchauvin6@gmail.com; dkim=pass reason="good signature" header.b=PHi9Km header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf742jzz1xmh","contextId": "93f36f34-827d-4633-b28c-e0aba9bd9588"} X-ppbforward : {"queueID":"4VYjf742jzz1xmh","server":"mlpnf0109"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0109.laposte.net (SMTP Server) with ESMTP id 4VYjf742jzz1xmh for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf738vnz1xmk","contextId": "e816072a-688b-4595-8439-8bad07312644"} X-lpn-mailing : LEGIT X-lpn-spamrating : 40 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=landryduchauvin6@gmail.com smtp.helo=mail-wr1-f41.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=PHi9Km; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (0)(0000)gggruggvucftvghtrhhoucdtuddrgedvledrvddvkedgleefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucenucfjughrpefkffgghffvufgtsehmtderredttdejnecuhfhrohhmpedfvefqhffkqdffkffufdcuoehlrghnughrhiguuhgthhgruhhvihhnieesghhmrghilhdrtghomheqnecuggftrfgrthhtvghrnhepffetgfejhfeiteelveegvdduhedtgeffieffgedtgfevgeejkefgtedtiedvkedvnecuffhomhgrihhnpehsvghnughisghtfedrtghomhenucfkphepvddtledrkeehrddvvddurdeguddpudehgedrieekrdehrdduvdejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvddtledrkeehrddvvddurdeguddphhgvlhhopehmrghilhdqfihruddqfheguddrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomheplhgrnhgurhihughutghhrghuvhhinheisehgmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepvghlvgdrlhgvmhhoihhnvgeslhgrphhoshhtvgdrnhgvthdpshhpfhepphgrshhspdgukhhimhepphgrshhspdgumhgrrhgtpehprghsshdprhgvvhfkrfepmhgrihhlqdifrhduqdhfgedurdhgohhoghhlvgdrtghomhdpghgvohfkrfepfgfu Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk

Pour Services Sécurité COFIDIS Recu 3ème mail en 1 semaine usurpant COFIDIS: Venant de l’adresse mail bidon: landryduchauvin6@gmail.com Et utilisant les adresses IP GOOGLE : 209.85.221.41 et Received : from TC-Cosmopsarus 154.68.5.127 à ABIDJAN en COTE d’IVOIRE IP Lookup Details: IP Information - 154.68.5.127 Host name: wimax-154.68.5.127.aviso.ci Country: Cote D'Ivoire Country Code: CI Region: 82 City: Abidjan Latitude: 5.3097 Longitude: -4.0127 Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk for <@laposte.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) Received : by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-34ddc9fe497so1913526f8f.3 for <@laposte.net>; Tue, 07 May 2024 08:59:59 -0700 (PDT) DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; xxxxxxxxxxxxxxxx CODES HTML des hackers ******************** Return-Path : <landryduchauvin6@gmail.com> Received : from mlpnf0109.laposte.net (mlpnf0109.sys.meshcore.net [10.94.128.88]) by mlpnb0108 with LMTPA; Tue, 07 May 2024 17:59:59 +0200 X-Cyrus-Session-Id : cyrus-213589-1715097599-1-3670923478525053547 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1715097599; cv=none; b=Wra6pr6q2rKxsN+790PhS+rbW9dZ46z7qHMwpHOTUHLJ/acN5QWyCd+CKqXiJEuI89p5fcQQZRs 8G0ZswsQ+iquVO7h+0iBf8XLNSeoPmTCemmTOSsDZ+vFIBlyrPslApevVQBPvApfFR2rqxw+tziD kEZfJjsSBC/6b34AkW7sAZaUvPR2+e2UEQsjwZxk1GEOhcnXCeAmLvEom3r4onSuQzOHAmiEOYjP hdOEELWxzsXDUOUlrEA2ozT19MMbfG8C5kUgFKRP0s57Zz9avHYuCjAtmuOEZc8xBJ5c+5Z2T0h2 Bb7vN0W//5LjzC6eYCRKQfvGoZdHOh/xfFPsFiQ== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1715097599; h=DKIM-Signature:Date:From:To:Subject; bh=9ah4qL0ow iWE5Q/hjto07kY7vrGVQF5+HoKat+gehWY=; b=sHLVibS8whrZXEnyvzf0Tax3jWICPXWKZX2KN TM4x37lBIJpNK6nAGFfCMXiYdl1TJwO3ZmHFtmz7RLMH+pillyK94ebOKXvHa97MhAnNrMH7mafR DgWS77r6W++OT81W/6qJIyk4zHcm089SDMLruMlbznXoE99hOORsV+67kabL26VZoW+UhrJCFTzU U72MchGGm5prGeXIxv1g8NW8PgUbYRzH4S42lOjS7fXKKqH4FBPXz1JTqEFID6dQl0zoS+a4o+kJ /i+yiAQ9y3EhepQt/8tL2SziWScTlA1673HV6UU/gh50p//epf2wK9am9RW/S/U4GVt/uFfCWa6l g== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail-wr1-f41.google.com smtp.mailfrom=landryduchauvin6@gmail.com; dkim=pass reason="good signature" header.b=PHi9Km header.d=gmail.com header.s=20230601; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf742jzz1xmh","contextId": "93f36f34-827d-4633-b28c-e0aba9bd9588"} X-ppbforward : {"queueID":"4VYjf742jzz1xmh","server":"mlpnf0109"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0109.laposte.net (SMTP Server) with ESMTP id 4VYjf742jzz1xmh for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Tue, 7 May 2024 17:59:59 +0200 (CEST) X-mail-filterd : {"version":"1.7.5","queueID":"4VYjf738vnz1xmk","contextId": "e816072a-688b-4595-8439-8bad07312644"} X-lpn-mailing : LEGIT X-lpn-spamrating : 40 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=landryduchauvin6@gmail.com smtp.helo=mail-wr1-f41.google.com; dkim=pass reason="good signature" header.d=gmail.com header.s=20230601 header.b=PHi9Km; dmarc=pass reason="SPF is aligned, DKIM is aligned"; arc=none smtp.remote-ip=209.85.221.41; bimi=skipped reason="non-compliant DMARC" X-lpn-spamcause : OK, (0)(0000)gggruggvucftvghtrhhoucdtuddrgedvledrvddvkedgleefucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedtudenucenucfjughrpefkffgghffvufgtsehmtderredttdejnecuhfhrohhmpedfvefqhffkqdffkffufdcuoehlrghnughrhiguuhgthhgruhhvihhnieesghhmrghilhdrtghomheqnecuggftrfgrthhtvghrnhepffetgfejhfeiteelveegvdduhedtgeffieffgedtgfevgeejkefgtedtiedvkedvnecuffhomhgrihhnpehsvghnughisghtfedrtghomhenucfkphepvddtledrkeehrddvvddurdeguddpudehgedrieekrdehrdduvdejnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepvddtledrkeehrddvvddurdeguddphhgvlhhopehmrghilhdqfihruddqfheguddrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomheplhgrnhgurhihughutghhrghuvhhinheisehgmhgrihhlrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtohepvghlvgdrlhgvmhhoihhnvgeslhgrphhoshhtvgdrnhgvthdpshhpfhepphgrshhspdgukhhimhepphgrshhspdgumhgrrhgtpehprghsshdprhgvvhfkrfepmhgrihhlqdifrhduqdhfgedurdhgohhoghhlvgdrtghomhdpghgvohfkrfepfgfu Received : from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mlpnf0109.laposte.net (SMTP Server) with ESMTPS id 4VYjf738vnz1xmk

It showed unusual activity in the server's error logs.

It was found that the IP had deployed rogue security software in our system.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

Attempts to access the server using known malicious IP addresses or domains.