This IP belongs to Valero Energy.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

It attempted to use the FTP server to distribute identity theft tools.

It made multiple requests with identical Accept-Charset headers.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

Multiple requests to the password reset page.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

The IP address initiated attacks using DDoS, impacting our server response times.

This IP belongs to 3M.

This IP belongs to PythonAnywhere.

It made various efforts to insert spyware to monitor SSH communications covertly.

This IP belongs to Swisscom.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

Multiple requests to the same endpoint in a short period of time.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

This IP was associated with targeted spear phishing attempts against our senior staff.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

The IP made multiple unsuccessful login attempts in a short period of time.

The IP attempted to perform a Bonk attack on the SSH server.