It was responsible for an unusual increase in server CPU usage.

It conducted an incursion on secure shell (SSH), attempting to tamper with encrypted data.

The IP attempted to perform a Ping of Death attack on the SSH server.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

This IP belongs to MetLife.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

This IP belongs to Vodafone.

The IP attempted to use the FTP server to distribute hacking tutorials.

A majority of our user base received phishing emails originated from this particular IP address.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

The IP made multiple requests with the same DNT header.

The IP attempted to perform Session Hijacking attacks on the Apache server.

It attempted to change file permissions on the FTP server.

It attempted to use the SASL server to relay spam.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

It attempted to use the SASL server to relay spam.

Damaging activities showing connections to rootkit attacks were associated with this IP.

This IP belongs to Amazon.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

It attempted to flood the Asterisk server with REGISTER requests.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

The IP attempted to delete directories on the SSH server.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.