Made various attempts at a forged return-path attack, attempting to spoof their source email address.

A multitude of spyware-infected download wrappers were linked to the spotted IP address.

It attempted to use the FTP server to distribute phishing emails.

The IP attempted to upload malicious files to the FTP server.

Recu Lundi 20 Mai 2024 après 05h01 (envoyés toujours les nuits, ou les week-ends ) 6ème même mail escroc usurpant ENCORE SNCF CONNECT et venant de l’adresse mail bidon des hackers: bolando@oncfosesncf.nvcdocv.fr Et adresse IP 46.101.154.140 en Allemagne Utilisant des serveurs mails oncfosesncf.nvcdocv.fr Adresse IP encore gérée par: noc@digitalocean.com et abuse@digitalocean.com Received : from oncfosesncf.nvcdocv.fr (oncfosesncf.nvcdocv.fr [46.101.154.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0104.laposte.net (SMTP Server) with ESMTPS id 4VjMlZ1f8FzqSH8; Mon, 20 May 2024 05:01:14 +0200 (CEST) Date : Mon, 20 May 2024 05:00:59 +0200 Authentication-Results : oncfosesncf.nvcdocv.fr; dkim=pass (2048-bit key; unprotected) header.d=oncfosesncf.nvcdocv.fr header.i=@oncfosesncf.nvcdocv.fr header.a=rsa-sha256 header.s=default header.b=gQ1XsTPF; dkim-atps=neutral IP Lookup Details: IP Information - 46.101.154.140 Host name: 46.101.154.140 Country: Germany Country Code: DE Region: 05 City: Frankfurt Latitude: 50.1167 Longitude: 8.6833 ************************* Codes HTML des hackers ********************* Return-Path : <bolando@oncfosesncf.nvcdocv.fr> Received : from mlpnf0104.laposte.net (mlpnf0104.sys.meshcore.net [10.94.128.83]) by mlpnb0108 with LMTPA; Mon, 20 May 2024 05:01:18 +0200 X-Cyrus-Session-Id : cyrus-77695-1716174078-2-365793295775652147 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1716174078; cv=none; b=KQd/CNn9O3dcLoRHrZx1JSOSoK5fqu39fm+oUDiHSBKlHwHgVjwvw0HcLF2oitGB/9NdZ18EX5m eckfV70aIJOKmbUJomUgRmvtkpvyWfvo9NtVqyVHlMNo6u+chhgNR7EMq3da70SnnNxMl9WuLM4d LLGImpXbz4D4aa6o4Udw79GNBrdPu2WpJv0XohI2YGljgmpVAMuSGWG6jBBMTr45MzWNkkbsHDHI eLhAhUffH+WLb36E9FB4WeLYpXA8HF4mmwWVP/EvsVBFHbHQmExUpUP3eV161vdd2/ButI18vfGZ fhY9AAqib1oq/wEI3xK51lhyCPkwymR3YBgS3gA== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1716174078; h=Date:To:From:Subject:DKIM-Signature; bh=ii7MTBCXk dNn29bBtuxxCaWxAkx2RjUl5OvxK/fPrCo=; b=NBgrO0teBTuvm4YpMhti9BVeXyo9GqBQHBWzK Ns8N3xxLth7RlN3k4Mqso3fWZ6cKzFt8oaq6B9OJKuUodJmQebYHUfGAcRri3ebhIuW901cudni

It attempted to send emails from the Postfix server that violate the server's email content policy.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

It attempted to perform a session hijacking attack on the SSH server.

It attempted to perform Race Condition attacks on the Apache server.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

It attempted to use the POP3 server to relay phishing emails.

This IP belongs to DuPont de Nemours.

The Israel lobby, also known as the Zionist lobby, are individuals and groups seeking to influence the United States government to better serve Israel's interests. The largest pro-Israel lobbying group is Christians United for Israel with over seven million members.<>] The American Israel Public Affairs Committee (AIPAC) is a leading organization within the lobby, speaking on behalf of a coalition of pro-Israel American Jewish groups. see why Israel can kill innocent children with American taxpayer money 1- Because the God of Money of our World is a Jew who supports and lives in Israel. For more details, click on the following link. https://mega.nz/file/FqhzGKbB#bsX4PD-O59HEA0-rynD29xkk47dmddycY5CjZfoDLYg 2- Because https://www.tiktok.com/@thefearlessqueenmel/video/7307640994579680542?lang=en&q=why%20dont%20Americans%20knowl%20what%20you%20have%20seen%20&t=1701880206555 See how innocent children are killed by the most powerful Israeli using American bombs at Al Jazeera Arabic Live at https://www.youtube.com/watch?v=bNyUyrR0PHo if you do not do something such as going on the street and telling your government which is controlled by the Jews to stop killing the Gaza people and stop the Israeli War and send food to the starving people of Gaza. If you can not do it then forward this message with the above two links to at least 4 of your friends and ask them to forward it to 4 of their friends so that the world will know that the new mass murderers are the Jews of the world . It is ironic that the Holocaust servicers (the Jews) are creating a new Holocaust against the Philistines in Gaza. if you do not do this also then you do not have a HART

This IP belongs to Exxon Mobil.

It attempted to use the FTP server to distribute pirated software.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

This IP belongs to CHS.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

This IP belongs to Gilead Sciences.

It attempted to use the FTP server to distribute zombie network tools.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

This IP belongs to PepsiCo.

This IP belongs to Alphabet.

Unusual patterns in the Accept-Language header.

This IP belongs to Lowe's.