The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

Our system flagged this IP as conducting fraudulent transactions activities.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

The IP attempted to perform a Bonk attack on the SSH server.

This IP belongs to 3M.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

The IP attempted to login to the SASL server with an invalid username.

It attempted to perform a Sentinels amplification attack on the SSH server.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

The IP was involved in a rapid sequence of login attempts.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

This IP belongs to Philip Morris International.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

This IP belongs to Airtel.

It attempted to flood the Asterisk server with REGISTER requests.

The IP attempted to register with the Asterisk server using an invalid username.

Unusual patterns in session IDs.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

Unusually high number of requests to a specific service or application within the server.

This IP belongs to DigitalOcean.