It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

The IP was linked to numerous attacks using web shells through web servers.

Multiple unsuccessful attempts to escalate privileges or access root account.

The IP attempted to register with the Asterisk server using an invalid username.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

It showed unusual activity in the server's error logs.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

This IP belongs to Sky Broadband.

It attempted to use the FTP server to distribute virus creation tools.

The IP under scrutiny has been associated with multiple modem hijackers.

The IP made multiple requests with the same Proxy-Connection header.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

We observed the IP distributing harmful document tracking tools.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

This IP belongs to DuPont de Nemours.