This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

It tried to use Cross-site scripting (XSS) attacks to inject malicious scripts into webpages viewed by users.

This IP belongs to General Dynamics.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

It attempted to perform a SSDP amplification attack on the SSH server.

It attempted to perform a SYN flood attack on the SSH server.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

This IP was accused of multiple unauthorized removal of security certificates.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

It attempted to use the SASL server to distribute malware.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

The IP made multiple unsuccessful login attempts in a short period of time.

This IP attempted to distribute malicious Javascript files.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

Incidents of privacy-invasive software floating in our network were linked to this IP.

The IP attempted to delete directories on the SSH server.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

This IP belongs to UnitedHealth Group.

This IP belongs to DigitalOcean.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

This IP was caught distributing malicious APK files.

GET /db/finance.dump: An attempt to access a database dump file.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.