This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

Hey mates! Just felt like to acquaint myself??”I'm the content owner of a recent drywall repair enterprise concentrated in seaside homes here in sun-drenched California. ???? With years and years of know-how under my belt and a zeal for helping homeowners, I'm pumped to bring my proficiency to communities along the coast. Whether you're managing with fissures, water damage, or just in necessity of a fresh coat of paint, my team and I are here to lend a hand. So if you're a California homeowner in required of some drywall TLC, don't dither to reach out! Let's work together to keep those walls appearing their best. ??–????

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

It attempted to perform a SIPVicious scan on the Asterisk server.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

Multiple requests to the same endpoint in a short period of time.

This IP belongs to BT Central Plus.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

This IP belongs to CHS.

This IP was distributing rogue security software, misleading users to think their systems are infected.

It was discovered illicitly scanning the server for potential vulnerabilities.

It attempted to create new directories on the SSH server.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

Unusual patterns in session IDs.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

This IP belongs to Telkom SA.

This IP belongs to Hostgator.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

It engaged in a click fraud operation using our server’s communication channels.

This IP blocked legitimate users by performing IP hijacking.

Conducted various IP scans, seeking loopholes in our network's security.