The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It attempted to perform a SSDP amplification attack on the SSH server.

This IP belongs to Goldman Sachs Group.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

It initiated multiple account lockouts in a short period.

It engaged in a click fraud operation using our server’s communication channels.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

This IP belongs to Wells Fargo.

It made multiple requests with the same Max-Forwards header.

The IP address has been involved in distributing adware to our server systems.

Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

The IP made multiple requests with the same TE header.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

This IP belongs to Microsoft Azure.