The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

This IP belongs to China Mobile.

This IP belongs to Berkshire Hathaway.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

This IP belongs to American Airlines Group.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

The IP attempted to perform a credential stuffing attack on the IMAP server.

Frequent password reset requests.

This IP attempted to disrupt our systems through the propagation of worms.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

Multiple requests to the same endpoint in a short period of time.

It tried to execute dictionary attacks on our Mail service causing potential delays.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

Our team has linked several viruses dissemination activities to this IP.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

We identified the IP address as a source of numerous scare tactics spyware.

It attempted to make unauthorized calls using the Asterisk server.

It showed unusual activity in the server's error logs.

Our team has linked several viruses dissemination activities to this IP.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

This IP belongs to Sprint.