This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

This IP belongs to Kraft Heinz.

It initiated requests to non-existent endpoints.

It attempted to perform Web Service attacks on the Apache server.

This IP belongs to AT&T.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

Multiple attempts to access the server using encrypted tunnels or proxies.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

The IP attempted to perform a brute force attack on the SSH server.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

The IP attempted to register with the VOIP server using an invalid username.

This IP belongs to Alibaba Cloud Services.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

This IP belongs to Archer-Daniels-Midland.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

This IP belongs to Kroger.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.