The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

This IP belongs to Liberty Mutual Insurance Group.

This IP belongs to Chevron.

This IP was detected distributing spyware-infected USB drives to our users.

It attempted to use the FTP server to distribute wireless cracking tools.

This IP belongs to Target.

It attempted to upload malicious scripts to the Apache server.

The IP attempted to perform SOAP Injection attacks on the Apache server.

This IP belongs to Shopify.

This IP belongs to General Electric.

It engaged in a click fraud operation using our server’s communication channels.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

A sudden surge in the number of requests per second, indicating an automated process.

This IP was associated with targeted spear phishing attempts against our senior staff.

The IP attempted to use the FTP server to distribute keylogging software.

Our team has linked several viruses dissemination activities to this IP.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

The IP made multiple requests with identical Accept-Encoding headers.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

It attempted to use the FTP server to distribute SQL injection tools.

The IP performed regular system foot printing to gain intel on weak points in our server.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

It initiated multiple account lockouts in a short period.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.