This IP belongs to Comcast.

It was identified as a BadBot, a type of bot that performs malicious activities.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

This IP belongs to Netflix.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

The IP attempted to use the POP3 server to distribute malware.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

It made multiple requests with the same X-Wap-Profile header.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

This IP belongs to Johnson & Johnson.

It made multiple requests with the same X-Forwarded-For header.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

Repeated attempts to exploit known vulnerabilities in server software.

This IP has been identified as running a botnet targeting our server systems with ransomware.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

Our network security detected the IP spreading malicious macros through document files.

This IP belongs to OVH.