Repeated attempts to alter or delete log files to cover tracks.

Damaging activities showing connections to rootkit attacks were associated with this IP.

It attempted to perform a password spraying attack on the IMAP server.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

Attempts to access the server using known malicious IP addresses or domains.

This IP belongs to Oracle.

This IP was found responsible for a session hijacking attempt on our network.

The IP attempted to send emails with misleading headers from the Mail server.

This IP belongs to Fannie Mae.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

GET /admin: Looking for an unprotected admin page.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

GET /errors.log: Shows an actor trying to access server error logs.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

This IP has been observed spreading mobile malware, targeting our company application users.

Unusual patterns in session IDs.

Unusual system or application errors related to authentication or access controls.

The IP attempted to use the FTP server to distribute malware.

The IP address has been linked to the creation of artificial traffic to crash our website.