http://49.185.160.77/

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

The IP attempted to register with the VOIP server using an invalid username.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This IP belongs to MetLife.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

The IP attempted to mark emails as read on the POP3 server without authorization.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

Multiple failed login attempts from the same IP address in a short span of time.

This IP belongs to Cigna.

It appears that this IP was initiating DNSChanger malware attacks on our network.

A majority of our user base received phishing emails originated from this particular IP address.

Multiple requests with the same X-Forwarded-For header.

It attempted to delete emails from the IMAP server without authorization.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

The IP made multiple requests to the server's robots.txt file.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.