This IP belongs to Oracle.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

This IP belongs to Telkom SA.

It attempted to use the FTP server to distribute password cracking tools.

The IP attempted to perform a downgrade attack on the SSH server.

This IP belongs to Charter Communications.

The IP attempted to gain unauthorized access to the Apache server.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

This particular IP has been used in advanced persistent threats against our servers.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

The IP was caught trying to overload the server through a Distributed Denial of Service attack.

It attempted to perform a session hijacking attack on the SSH server.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

Login attempts from foreign IP addresses.

It made multiple requests from user agents claiming to be bots.

Multiple requests with the same Referer header.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

The IP showed unusual patterns in session IDs.

The IP attempted a Rootkit installation to gain root access and control server activity.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

This IP belongs to Bank of America.