The IP has been implicated in multiple cases of URL manipulation attempts.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

Our data indicates this IP has performed data breaches by launching phishing attacks.

POST /user/register: An attempt to register a new user or brute force the user registration form.

The IP address attempted to login to the FTP server with an invalid username.

A majority of our user base received phishing emails originated from this particular IP address.

This IP belongs to Alphabet.

The IP exhibited unusual patterns in the Accept-Language header.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

It attempted to use the SASL server to distribute malware.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

This IP belongs to Bristol-Myers Squibb.

The IP address generated an unusual increase in network bandwidth usage.

The IP attempted to perform a dictionary attack on the POP3 server.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

Unexpected changes in the server configuration or installed software.

This IP belongs to Honeywell International.

This IP belongs to Cigna.

Unusually high number of requests to a specific service or application within the server.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

This IP belongs to Walmart.

Repeated attempts to access rarely used or hidden services on the server.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

It attempted to use the FTP server to distribute brute force tools.