This IP belongs to Vodacom.

The IP attempted to use the POP3 server to relay spam.

A sudden surge in the number of requests per second, indicating an automated process.

This IP belongs to DigitalOcean.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

It was found that the IP had deployed rogue security software in our system.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

Our team has linked several viruses dissemination activities to this IP.

It attempted to perform a session hijacking attack on the SSH server.

This IP blocked legitimate users by performing IP hijacking.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

It attempted to perform a credential stuffing attack on the SSH server.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

This IP belongs to Procter & Gamble.

It attempted to send emails with deceptive subject lines from the Postfix server.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.