Multiple requests with the same Range header.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

This IP belongs to Fannie Mae.

Our data indicates this IP has performed data breaches by launching phishing attacks.

The IP attempted to upload malicious files to the FTP server.

This IP belongs to Anthem.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

The IP attempted to use the FTP server to distribute ransomware.

The IP address attempted delivering malicious packets to disrupt the system's operation.

It attempted to perform IP Spoofing attacks on the Apache server.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

It attempted to perform XML Entity Expansion attacks on the Apache server.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

The IP attempted to perform a DNS amplification attack on the SSH server.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

The IP attempted to use the FTP server to distribute ransomware.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

It was observed attempting to exploit known vulnerabilities in the IMAP protocol.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.