The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

It attempted to perform Session Sidejacking attacks on the Apache server.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

This IP belongs to Amazon.

Attempts to access the server using credentials that have been involved in previous security incidents.

This IP belongs to Marathon Petroleum.

This IP attempted to distribute malicious Javascript files.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

Spam Mails from 95.246.156.161 received !

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

This IP belongs to Heroku.

The IP has been implicated in multiple cases of URL manipulation attempts.

This IP belongs to Tech Data.

It was responsible for an unusual increase in server CPU usage.

GET /db/finance.dump: An attempt to access a database dump file.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

Our data indicates this IP has performed data breaches by launching phishing attacks.

The IP attempted to perform a Ping of Death attack on the SSH server.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

This IP belongs to Swisscom.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.