
This is where you are:
IP Information - 3.16.109.195
Host name: ec2-3-16-109-195.us-east-2.compute.amazonaws.com
Country: United States
Country Code: US
Region: WA
City: Seattle
Latitude: 47.6344
Longitude: -122.3422
The IP address attempted delivering malicious packets to disrupt the system's operation.
A series of active scareware campaigns was traced back to this IP address.
The IP attempted to perform Session Hijacking attacks on the Apache server.
Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.
It attempted logins using outdated protocols.
The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.
Attempts to login using a sequential list of passwords, indicating a possible brute force attack.
Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.
Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.
This IP belongs to Northwestern Mutual.
The IP was flagged for attempting dictionary attacks on our user accounts.
Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.
Multiple requests with the same X-Requested-With header.
Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.
The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.
The IP address initiated attacks using DDoS, impacting our server response times.
It attempted to use the FTP server to distribute password recovery tools.
It attempted to use the IMAP server to relay spam.
This IP belongs to Bank of America.
The IP attempted to use the FTP server to distribute spam.
This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.
