This IP belongs to Optus.

Multiple requests with the same X-Wap-Profile header.

This IP belongs to Slack.

This particular IP has been used in advanced persistent threats against our servers.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

It engaged in a click fraud operation using our server’s communication channels.

It was responsible for an unusual increase in server CPU usage.

It attempted to perform a Chargen amplification attack on the SSH server.

This IP belongs to Valero Energy.

It made numerous requests to the same endpoint in a short time.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

This IP belongs to NetEase.

The IP attempted to perform a dictionary attack on the POP3 server.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

This IP was caught distributing malicious APK files.

This IP belongs to Kroger.

Multiple requests with the same Origin header.

It attempted to perform a RIPv1 amplification attack on the SSH server.

The IP made multiple requests with the same Via header.

It appears that this IP was initiating DNSChanger malware attacks on our network.

It attempted to login to the SSH server with an invalid password.

This IP belongs to Telus Communications.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.