The IP attempted to use the FTP server as a proxy for other malicious activities.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

Unusual system or application errors related to authentication or access controls.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

The IP attempted to send emails from the Postfix server without proper authentication.

It attempted to list the contents of directories that it should not have access to.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

This IP belongs to FedEx.

This IP belongs to SK Broadband.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

It attempted to use the FTP server to distribute pirated software.

This IP belongs to Dow Chemical.

Unusually high number of requests to a specific service or application within the server.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

This IP belongs to Kroger.

It attempted to change file permissions on the FTP server.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

This IP belongs to DuPont de Nemours.

It attempted to use the FTP server to distribute zombie network tools.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

Our team has linked several viruses dissemination activities to this IP.

The specific IP has been identified attempting to load malicious browser helper objects into the network.