It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

It attempted logins using outdated protocols.

This IP belongs to Prudential Financial.

Login attempts using old or outdated protocols.

Excessive traffic from a single IP address.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

The IP attempted to use the FTP server to distribute keylogging software.

A large number of requests from a single user agent, suggesting an automated process.

This IP belongs to Globe Telecom.

It attempted to change file permissions on the FTP server.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

The IP was involved in a Directory Traversal attack, attempting to access restricted directories and files.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to Humana.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

The IP address initiated attacks using DDoS, impacting our server response times.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

It attempted to perform Command Injection attacks on the Apache server.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

It attempted to flood the Asterisk server with REGISTER requests.