It appears that this IP was initiating DNSChanger malware attacks on our network.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

The IP attempted to perform a SIP Invite Flood on the SIP server.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

It attempted to send phishing emails from the Mail server.

This IP belongs to Shopify.

It made multiple requests with identical POST parameters.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

This IP belongs to Kraft Heinz.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

This IP belongs to Shaw Communications.

This IP belongs to Morgan Stanley.

This IP belongs to Microsoft Azure.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

This IP belongs to Deutsche Telecom.

The IP attempted to mark emails as read on the IMAP server without authorization.

This IP blocked legitimate users by performing IP hijacking.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

Numerous incidents of botnet infestations were traced back to this offensive IP address.

Attempts to use privileged service accounts outside of their normal usage patterns.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Unexpected changes in the server configuration or installed software.