555

4111111111111111

555

555

555

4111111111111111

4111111111111111

4111111111111111

4111111111111111

4111111111111111

4111111111111111

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

It attempted to perform a credential stuffing attack on the SSH server.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

It made numerous requests to the same endpoint in a short time.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

This IP belongs to Alibaba Cloud Services.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It initiated requests to non-existent endpoints.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

The IP attempted to use the FTP server to distribute DDoS attack tools.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

This IP belongs to China Mobile.

This IP was distributing rogue security software, misleading users to think their systems are infected.