The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

This IP belongs to GoDaddy.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

It attempted to perform HTTP Parameter Pollution attacks on the Apache server.

It attempted to use the FTP server to distribute traffic monitoring tools.

It attempted to delete emails from the IMAP server without authorization.

This IP belongs to ConocoPhillips.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP attempted to change file permissions on the SSH server.

The IP attempted to perform a Fraggle attack on the SSH server.

This IP belongs to Kroger.

The IP made multiple requests to the password reset page.

This IP belongs to 3M.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

POST /user/register: An attempt to register a new user or brute force the user registration form.

The suspicious IP attempted to introduce spyware under the guise of software updates.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

It persistently tried to exploit weaknesses in the SSH communication encryption.