Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

This IP belongs to Exxon Mobil.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

The IP attempted to perform Format String attacks on the Apache server.

The IP showed unusual patterns in referrer URLs.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

This IP belongs to Valero Energy.

It attempted to execute unauthorized commands on the Apache server.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

The IP attempted to perform a credential stuffing attack on the POP3 server.

The said IP has been connected to attempts to distribute malicious shopping apps.

Multiple requests with identical POST parameters.

This IP belongs to Costco Wholesale.

This IP belongs to Tyson Foods.

This IP belongs to Marathon Petroleum.

It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

It attempted to perform Session Prediction attacks on the Apache server.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

It attempted to use the FTP server to distribute virus creation tools.

This IP belongs to Twenty-First Century Fox.

FOR YOUR INFORMATIONS and ACTIONS against these Bastards HACKERS USING your servers IP and accounts and mails boxes ! Pour votre Information et Actions contre ces hackers utilisant vos serveurs IP, comptes et boites mails ! Recu 2ème mail escroc usurpant la Banque NICKEL avec utilisation des serveurs IP website@multigama.ro et adresse mail 92.86.6.214 en ROUMANIE ! Recu Vendredi 01 Novembre 2024 après 04h23 du matin ( mails escrocs toujours envoyés les nuits ou week-ends ) le mail ci-dessous usurpant la banque NICKEL : venant de la boite mail en ROUMANIE: From: "Nickel" <website@multigama.ro> avec utilisation des serveurs IP mail.multigama.ro et adresse IP 92.86.6.214 en ROUMANIE gérée par registry@orange.com Received : from mail.multigama.ro (mail.multigama.ro [92.86.6.214]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mlpnf0110.laposte.net (SMTP Server) with ESMTPS id 4XfmQx4j5tz1nrwM for <@laposte.net>; Fri, 1 Nov 2024 04:23:21 +0100 (CET) Received : from mail.multigama.ro (mail.multigama.ro [127.0.0.1]) by mail.multigama.ro (Postfix) with ESMTP id 2353C242601E for <@laposte.net>; Fri, 1 Nov 2024 05:23:21 +0200 (EET) Authentication-Results : mail.multigama.ro (amavisd-new); dkim=pass (1024-bit key) reason="pass (just generated, assumed good)" header.d=multigama.ro DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/simple; d=multigama.ro; h= date:date:reply-to:mime-version:content-type:content-type:to :subject:subject:from:from; s=dkim; t=1730431399; x=1731295400; bh=Zsm5M9SyohHZ/sjYzI0HjeEdxF5FknDKHjplADT2pKw=; b=b9KSExMt4PAr dwB7DpZ+ZRazSSOfVLx2TJQMEWLydGLWmjGX5FAwcgUYgsOlj8N1tB9lmKvJqmta HsSiTQJwEp2+CvfVJ0riOOv8aCzf60wptKq7l77moWb/9FyHfZRg7y3etIFy0w/G HTdVZq/GUENSdV8YGHVIba3RbzVI3wY= X-Virus-Scanned : amavisd-new at mail.multigama.ro X-Spam-Flag : NO X-Spam-Score : -88.248 IP Lookup Details: IP Information - 92.86.6.214 Host name: mail.multigama.ro Country: Romania Country Code: RO Region: 30 City: Ploiesti Latitude: 44.95 Longitude: 26.0167 ********************* Contenu du mail des hackers ***************** votre compte a été suspendu • vendredi 1er Novembre, 04:23 (il y a 3 jours) 69Ko • • • N De : Nickel • A : Moi • xxxxxxxxxxxxxxxxxxxxxxxxxxx CODES HTML des hackers xxxxxxxxxxxxxxxxxxxx Return-Path : <website@multigama.ro> Received : from mlpnf0110.laposte.net (mlpnf0110.sys.meshcore.net [10.94.128.89]) by mlpnb0108 with LMTPA; Fri, 01 Nov 2024 04:23:21 +0100 X-Cyrus-Session-Id : cyrus-146501-1730431401-1-18218882384614870810 X-Sieve : CMU Sieve 3.0 ARC-Seal : i=1; a=rsa-sha256; d=laposte.net; s=lpn-wlmd; t=1730431401; cv=none; b=i9H0AOg5Y6tjg0xiUlx5cZR6q2OOBnZVpwWLYGc2oZhAvgJYzcNzDuhbTfQ0PPMbbxMYqY/2kTy VuP1voy7YO339gTPgqREGHOGDNJ+N3bXLyZMaaz8ZrHCJadqcZ2Z/Mo/Fkl/bmbQZ0qqeOUJ9o03 R1TWfK1fjn3+psjMmNfkF2RPCWeuTyYdIy0cF6NRuqRzZRAgs1lRMENEmfFeZ0j/Qh0GEdIlguU9 fGjG0NfwMPScOpsDZ66krq4NXRGB9ifSGPhSlH9HJmqaYITuBFqslcINluigkHC3Ns6diN5Ygpb+ sIPCjvhHJRxtBehQh1FNbXYsOBgTxVJjqKNyVPw== ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=laposte.net; s=lpn-wlmd; t=1730431401; h=DKIM-Signature:From:Subject:To:Reply-To:Date; bh= uK/Ei055Hs3VmXS7LeNTO+7NT4mvTjdzFxPaIlWO4X8=; b=Na757CmYb6RIhxO9Y+C6P7f1+vCm jbVZA1AThVPO6I75wZqre4W0s4onVz5dtBZUrmyjjN8h3r/ufznzJqQv+Qk3XMzaaaDcXXqpOXo7 jAcQqPDU+xxjCoFvG1kUNgVLYkA8CP0ZnMeTmTcDdWbQCfGGQfHynL1lh/ow5j1NjLbQY8HIOvBx +HMjRuIUwvw1rmkWqNxE4WKM0vNoErl0hm66xDiEE8qceL97tRf2hYjZFOujTu0zaMg6MY82DEb1 LH6gm02L8le5c2/bh42ZCBtlIFENMsE+IxOCKQyX+p6m5A4nY6mrGvBYLtJ9xF4XiycFTfqWZOiI ISeOZ9vUsw== ARC-Authentication-Results : i=1; laposte.net; spf=pass smtp.helo=mail.multigama.ro smtp.mailfrom=website@multigama.ro; dkim=pass reason="good signature" header.b=b9KSEx header.d=multigama.ro header.s=dkim; dmarc=none reason="No policy found"; arc=none smtp.remote-ip=92.86.6.214; bimi=skipped reason="non-pass DMARC" X-mail-filterd : {"version":"1.8.0","queueID":"4XfmQx5t42z1nrwL","contextId": "9d360225-60c3-4754-a2aa-566c1762ecff"} X-ppbforward : {"queueID":"4XfmQx5t42z1nrwL","server":"mlpnf0110"} Received : from outgoing-mail.laposte.net (localhost.localdomain [127.0.0.1]) by mlpnf0110.laposte.net (SMTP Server) with ESMTP id 4XfmQx5t42z1nrwL for <lpn000000000000000018870443@back01-mail02-04.lpn.svc.meshcore.net>; Fri, 1 Nov 2024 04:23:21 +0100 (CET) X-mail-filterd : {"version":"1.8.0","queueID":"4XfmQx4j5tz1nrwM","contextId": "4b68d5e6-605e-42a2-8927-744c72b1d764"} X-lpn-mailing : LEGIT X-lpn-spamrating : 40 X-lpn-spamlevel : not-spam Authentication-Results : laposte.net; spf=pass smtp.mailfrom=website@multigama.ro smtp.helo=mail.multigama.ro; dkim=pass reason="good signature" header.d=multigama.ro header.s=dkim header.b=b9KSEx; dmarc=none reason="No policy found"; arc=none smtp.remote-ip=92.86.6.214; bimi=skipped reason="non-pass DMARC" X-lpn-spamcause : OK,

The IP attempted to download emails from the IMAP server without authorization.

Multiple requests with identical POST parameters.