The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

The IP made multiple requests with the same X-UIDH header.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

This IP belongs to Linode.

This IP belongs to WordPress.com.

Participated in the notorious Water Torture attack to overload our DNS servers.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

This IP belongs to Anthem.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This IP belongs to Facebook.

The IP made multiple requests with the same If-Range header.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

This IP belongs to Amazon.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

The IP attempted to send malware-infected attachments from the Mail server.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP made multiple requests with the same Origin header.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

This IP belongs to Allstate.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to AT&T.

This IP exhibited malicious sophistication by employing multi-vector attacks.

It showed unusual activity in the server's error logs.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.