This IP belongs to Cardinal Health.

It attempted to use the SASL server to distribute malware.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

Participated in malicious pranks by altering messages sent through the server.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

The IP attempted to use the FTP server to distribute ransomware.

The IP attempted to perform a credential stuffing attack on the IMAP server.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

This IP belongs to Northwestern Mutual.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

The IP attempted to delete files from the FTP server.

This IP belongs to SK Broadband.

This IP belongs to Nintendo.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

It attempted to send emails with malicious links from the Mail server.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.