It attempted to use the FTP server to distribute pirated software.

The IP attempted to perform a credential stuffing attack on the IMAP server.

This particular IP tried to perform an unauthorized system configuration change.

The IP attempted to use the FTP server to distribute data recovery tools.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

This IP belongs to Pfizer.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

The IP address attempted to login to the FTP server with an invalid username.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP attempted to use the FTP server to distribute anonymizing tools.

Multiple attempts to access the server using encrypted tunnels or proxies.

It attempted to send emails from the Mail server that violate the server's email content policy.

This IP belongs to Microsoft.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

It attempted to exploit known vulnerabilities in the SSH protocol.

The IP attempted to perform Integer Overflow attacks on the Apache server.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

A sudden surge in the number of requests per second, indicating an automated process.

Multiple failed attempts to use the server’s API.

The IP made multiple requests using uncommon HTTP methods.

This IP belongs to CVS Health.