It was found initiating attack vectors to exploit SSH agent forwarding.

It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

udden increase in account lockouts due to multiple failed login attempts.

udden increase in account lockouts due to multiple failed login attempts.

Unexpected changes in the server configuration or installed software.

Multiple requests with identical Accept-Charset headers.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

It attempted to upload malicious files to the SSH server.

This IP belongs to Cigna.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

The IP attempted to perform a dictionary attack on the POP3 server.

The IP attempted to use the FTP server as a proxy for other malicious activities.

This IP belongs to Verizon Communications.

The IP attempted to use the POP3 server to relay spam.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

The IP attempted to perform a brute force attack on the SASL server.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

This IP attempted to disrupt our systems through the propagation of worms.

The IP attempted to perform a QOTD amplification attack on the SSH server.

The IP made multiple requests with the same Via header.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

This IP belongs to SingTel.