It attempted to delete emails from the POP3 server without authorization.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.

The IP attempted to download emails from the POP3 server without authorization.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

The IP attempted to perform a dictionary attack on the POP3 server.

This IP belongs to Nexon.

A series of active scareware campaigns was traced back to this IP address.

This IP has been identified as running a botnet targeting our server systems with ransomware.

Repeated failed attempts to perform actions that require higher privileges.

It attempted to use the FTP server to distribute terrorist propaganda.

It initiated requests to non-existent endpoints.

It made multiple requests with the same Max-Forwards header.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

Unusual network traffic patterns, such as a high amount of outbound traffic.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

This IP attempted to distribute malicious Javascript files.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

This IP executed mass-probing of various ports to seek vulnerabilities.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

This IP belongs to New York Life Insurance.