This IP belongs to AT&T.

Multiple requests with the same Origin header.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to Alphabet.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

Frequent password reset requests.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

The IP attempted to use the FTP server to distribute steganography tools.

The IP attempted to use the FTP server to distribute malware.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

Unusual increase in network bandwidth usage.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

The IP exhibited unusual patterns in the Accept-Language header.

It attempted to take advantage of misconfigurations in the Apache server.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

The IP has been implicated in multiple cases of URL manipulation attempts.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

The IP attempted to perform a replay attack on the IMAP server.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

It attempted to exploit known vulnerabilities in the FTP protocol.

The IP attempted to delete directories on the SSH server.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

It attempted to perform a man-in-the-middle attack on the SSH server.

This particular IP has been used in advanced persistent threats against our servers.