This IP belongs to Korea Telecom.

This IP belongs to United Technologies.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

It made multiple requests with identical POST parameters.

This IP belongs to Caterpillar.

This IP belongs to Exelon.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

The IP was linked to numerous attacks using web shells through web servers.

It made multiple requests with the same X-Csrf-Token header.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

Finally, the IP was caught in the act of Abandoned Object attacks, creating objects with no reference to exhaust memory space

This IP belongs to United Technologies.

The IP attempted to perform a password spraying attack on the SASL server.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

This IP belongs to Vodafone.

This IP belongs to MetLife.

Several phishing emails have been traced back to this suspicious IP address.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

The specific IP has been identified attempting to load malicious browser helper objects into the network.