It was responsible for an unusual increase in server CPU usage.

This IP belongs to Oracle.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

This IP was distributing rogue security software, misleading users to think their systems are infected.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

This IP belongs to Travelers Cos.

The IP attempted to use the FTP server to distribute forensics tools.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

It attempted to download sensitive files from the FTP server.

This IP belongs to MTS (Mobile TeleSystems).

It showed unusual patterns in the sequence of requests.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

It attempted to send emails from the Mail server that violate the server's email content policy.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

The IP attempted to use the FTP server to distribute credit card fraud tools.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.