This IP belongs to Anthem.

The IP attempted to use the FTP server to distribute rootkit software.

This IP belongs to Kraft Heinz.

A series of active scareware campaigns was traced back to this IP address.

The IP attempted to use the FTP server to distribute anonymizing tools.

It attempted to perform Buffer Overflow attacks on the Apache server.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

Incidents of privacy-invasive software floating in our network were linked to this IP.

GET /login.action: Trying to find a Struts2 application to exploit.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

The IP sent numerous SIP OPTIONS requests in a short time.

This IP belongs to China Mobile.

Seems like someone couldnt keep their paws off the admin logs again guess they forgot to cover their tracks

We identified the IP address as a source of numerous scare tactics spyware.

Somthing fishy

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

The IP sent numerous SIP OPTIONS requests in a short time.

Saw some weird hits coming through the server logs lateday yesterday. It was hammering our login endpoint over and over like it was on replay. I threw a block at it but it just reappears wit slight ip shifts. Time to eyeball the firewall rules again cause this dont feel legit.

The IP address has been involved in distributing adware to our server systems.

This IP belongs to Wikimedia Foundation.

We flagged down attempts from the IP to leak backdoor viruses into the system.

Not sure whats goin on but some stranger just tried poking around my account outta nowhere. I only ever click on the links I trust yet this felt off and kinda fishy. Maybe its a glitch in the system or some sneaky scammer testing doors. Either way I’m keeping my eyes peeled from here on out.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

Multiple requests with identical Accept-Encoding headers.