The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

Attempts to use automated scripts or tools for password cracking.

The IP exhibited unusual patterns in the Accept-Language header.

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

Recu Vendredi 10 Mai 2024 après 04h11 (envoyés toujours les nuits, ou les week-ends ) 5ème même mail escroc usurpant ENCORE SNCF Connect et venant de l’adresse mail bidon des hackers: bolando@xlrhgsesncf.lpmnbi.fr Et adresse IP 134.122.68.16 Received : from xlrhgsesncf.lpmnbi.fr (xlrhgsesncf.lpmnbi.fr [134.122.68.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0119.laposte.net (SMTP Server) with ESMTPS id 4VbC6R3xlxzKm4J; Fri, 10 May 2024 04:11:11 +0200 (CEST) Date : Fri, 10 May 2024 04:10:53 +0200 Authentication-Results : xlrhgsesncf.lpmnbi.fr; dkim=pass (2048-bit key; unprotected) header.d=xlrhgsesncf.lpmnbi.fr header.i=@xlrhgsesncf.lpmnbi.fr header.a=rsa-sha256 header.s=default header.b=S9Lu2A0v; dkim-atps=neutral Utilisant des serveurs mails lpmnbi.fr et venant de l’adresse IP 134.122.68.16 aux U.S.A adresse IP gérée par: noc@digitalocean.com et abuse@digitalocean.com

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

Recu Vendredi 10 Mai 2024 après 05h48 (toujours les nuits, ou les week-ends) mail escroc usurpant la FRANCAISE des JEUX et venant de l’adresse mail escroc des hackers: rebecca.roineau@culture.gouv.fr venant de l’adresse Originating-IP: 143.126.211.17 gérée par : abuse@ripe.net et hostmaster@ripe.net Received : from lares.culture.fr (lares.culture.fr [143.126.211.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0111.laposte.net (SMTP Server) with ESMTPS id 4VbFGH2d3JzTgCF; Fri, 10 May 2024 05:48:07 +0200 (CEST) Received : from pasteur03.culture.fr (pasteur03.culture.fr [143.126.201.124]) by lares.culture.fr with ESMTP id 44A3m16O024267-44A3m16P024267; Fri, 10 May 2024 05:48:01 +0200 Received : from msg-p0-exc511.atm.ad.culture.fr (heckel.culture.fr [143.126.201.38]) by pasteur03.culture.fr (8.17.1.19/8.17.1.19) with ESMTPS id 44A3ljMZ010770 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Fri, 10 May 2024 05:47:45 +0200 Received : from msg-p0-exc514.atm.ad.culture.fr (143.126.225.37) by msg-p0-exc511.atm.ad.culture.fr (143.126.225.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Fri, 10 May 2024 05:47:41 +0200 Received : from msg-p0-exc514.atm.ad.culture.fr ([fe80::61d7:3fd0:643b:29c5]) by msg-p0-exc514.atm.ad.culture.fr ([fe80::61d7:3fd0:643b:29c5%5]) with mapi id 15.01.2507.035; Fri, 10 May 2024 05:47:40 +0200 From : ROINEAU Rébecca <rebecca.roineau@culture.gouv.fr> x-originating-ip : [143.126.211.17] et venant de l’adresse IP 143.126.211.17 gérée par : abuse@ripe.net et hostmaster@ripe.net

This IP belongs to Vodafone.

The IP attempted to perform Symlink attacks on the Apache server.

It made multiple requests with the same X-Forwarded-For header.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

Our data indicates this IP has performed data breaches by launching phishing attacks.

This IP belongs to Zayo Bandwidth.

The IP attempted to perform Integer Overflow attacks on the Apache server.

This IP belongs to New York Life Insurance.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

The IP attempted to bypass the SASL server's authentication mechanism.

This IP was caught circulating email worms, camouflaged as legitimate mails.

The IP was marked attempting to use infamous 'Ramnit' malware to steal sensitive Apache server data.

This IP belongs to Shaw Communications.

This IP belongs to Shaw Communications.