This IP belongs to GitHub.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

The IP made multiple requests with the same Proxy-Connection header.

The IP attempted to use the FTP server to distribute ransomware.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

This IP belongs to Tumblr.

It attempted to use the FTP server to distribute pirated software.

This IP belongs to Deutsche Telekom AG.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

The IP attempted to perform a DNS amplification attack on the SSH server.

The IP attempted to create new directories on the FTP server.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

This IP belongs to Wikimedia Foundation.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

It attempted to perform a Teardrop attack on the SSH server.

Multiple requests with the same Referer header.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

The IP attempted to use the FTP server to distribute rootkit software.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

This IP belongs to Phillips 66.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.