This IP belongs to Tumblr.

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

GET /administrator.php: Attempting to access an admin interface.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

POST /admin/upload.php?_upl: An attempt to exploit the JQuery File Upload vulnerability.

It attempted to perform Heap Overflow attacks on the Apache server.

The IP made multiple requests with the same If-Range header.

It tried to execute dictionary attacks on our Mail service causing potential delays.

This IP was associated with targeted spear phishing attempts against our senior staff.

Multiple failed login attempts using different usernames.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

The IP made multiple requests with the same Warning header.

It attempted to make unauthorized calls using the VOIP server.

It was discovered illicitly scanning the server for potential vulnerabilities.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

It attempted to change file permissions on the FTP server.

The said IP has been connected to attempts to distribute malicious shopping apps.

It attempted to exploit known vulnerabilities in the Mail protocol.

This IP belongs to Nexon.

The IP has been implicated in multiple cases of URL manipulation attempts.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

This IP belongs to Canadian Department of Defense.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.