The IP attempted to use the FTP server to distribute spam.

Login attempts using old or outdated protocols.

The IP attempted to use the FTP server as a proxy for other malicious activities.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

Several cross-site scripting attacks were traced back to this IP.

Multiple requests with the same X-Csrf-Token header.

This IP belongs to Valero Energy.

The IP made multiple requests with the same X-UIDH header.

It attempted to use the Postfix server to relay spam to other servers.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

The reported IP was identified as a BadBot, engaging in harmful activities such as unauthorized web scraping and data mining.

Multiple requests with identical POST parameters.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

GET /admin: Looking for an unprotected admin page.

The IP attempted to perform a replay attack on the POP3 server.

This IP belongs to SingTel.

This IP belongs to TELUS Communications.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

It made multiple requests with the same Range header.

It attempted to perform a password spraying attack on the POP3 server.

This IP belongs to The Hartford Financial Services.

This IP belongs to Lowe's.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.