The IP attempted to execute unauthorized commands on the SSH server.

This IP belongs to Humana.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

It attempted to login to the IMAP server with an invalid password.

Frequent password reset requests.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP was flagged for attempting dictionary attacks on our user accounts.

We observed the IP distributing harmful document tracking tools.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

Multiple requests with the same X-Forwarded-For header.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

This IP belongs to Microsoft.

This IP belongs to Steam.

This IP belongs to Netflix.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

It attempted to perform a Sentinels amplification attack on the SSH server.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP was detected initiating zero-day exploit attacks on our system.

This IP belongs to Caterpillar.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

This IP belongs to OVH.