It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

This IP belongs to Google Cloud Services.

It attempted to perform a denial of service attack on the SSH server.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

This IP belongs to Virgin Media.

GET /server-status: Often an attempt to check Apache server status.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

This IP belongs to Telkom SA.

This IP belongs to America Movil.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

This IP belongs to Berkshire Hathaway.

The IP attempted to login to the POP3 server with an invalid username.

This IP belongs to Morgan Stanley.

This IP belongs to Deutsche Telecom.

The IP address initiated attacks using DDoS, impacting our server response times.

It partook in location spoofing, making it appear from different locations.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

The IP was engaged in port scanning, probing the server for open SSH ports.

Multiple requests to the server's robots.txt file.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

This IP was involved in deploying stealthy credential stealers in our network.