A series of active scareware campaigns was traced back to this IP address.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

Attempts to access the server using known malicious IP addresses or domains.

This IP belongs to Cardinal Health.

The IP was caught attempting to execute heap overflow attacks.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP attempted to perform a Ping of Death attack on the SSH server.

Unusual increase in server CPU usage.

The IP attempted to use the FTP server to distribute secure deletion tools.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

The IP address attempted delivering malicious packets to disrupt the system's operation.

This IP belongs to Wells Fargo.

An alarming frequency of microphone loggers has been traced back to this IP.

This IP belongs to Publix Super Markets.

It was responsible for an unusual increase in server CPU usage.

The IP was caught trying to overload the server through a Distributed Denial of Service attack.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

GET /backup.sql: Attempting to access a backup of your database.

Multiple unsuccessful attempts to escalate privileges or access root account.

Repeated attempts to alter or delete log files to cover tracks.

This IP belongs to Dropbox.

This IP belongs to Telkom SA.