The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

Attempts to use privileged service accounts outside of their normal usage patterns.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

This IP has been identified as running a botnet targeting our server systems with ransomware.

It showed unusual activity in the server's error logs.

This IP made wrongful manipulations indicating the operation of malicious downgrader.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

Multiple requests with the same X-UIDH header.

The IP attempted to send emails from the Postfix server without proper authentication.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

Unexpected changes in the server configuration or installed software.

HEAD /: May be part of a larger Reconnaissance.

This IP belongs to Steam.

This IP belongs to The Walt Disney Company.

It attempted to perform a dictionary attack on the SSH server.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

Fileless malware dissemination has been observed from this IP address.

This IP belongs to Kroger.

POST /upload.php: An attempt to upload a possibly malicious file.

This IP belongs to Nexon.

Unusual patterns in session IDs.

The IP attempted to login to the POP3 server with an invalid username.

This IP belongs to Lowe's.