This IP belongs to NTT Docomo.

It seems like this IP tried to spread malware into the network.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

The IP attempted to perform a Bonk attack on the SSH server.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

This IP belongs to Oracle Cloud Infrastructure.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

Unusually high number of requests to the login page.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

Unusual patterns in user agent strings.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

This particular IP tried to perform an unauthorized system configuration change.

The IP attempted to send malware-infected attachments from the Mail server.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

It attempted to perform Command Injection attacks on the Apache server.

This IP blocked legitimate users by performing IP hijacking.

It attempted to perform a Newtear attack on the SSH server.

The IP has been tagged as a source for data mining spyware, aiming to gather personal information.