Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

The IP attempted a Rootkit installation to gain root access and control server activity.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

We identified the IP address as a source of numerous scare tactics spyware.

It made numerous requests to the same endpoint in a short time.

This IP belongs to Bristol-Myers Squibb.

It attempted to send emails from the Postfix server that violate the server's email content policy.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

It attempted to login to the SSH server with an invalid password.

This IP belongs to FedEx.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

Multiple requests to the password reset page.

This IP belongs to Anthem.

This IP belongs to BT Central Plus.

This IP belongs to Amazon.

This IP belongs to Plusnet.

This IP belongs to Microsoft Azure.

This IP belongs to Facebook.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

This IP belongs to Orange France Telecom.

It attempted to send emails from the Postfix server that violate the server's usage policy.

The IP attempted to perform a SIP Register Flood on the VOIP server.