A dangerous data surveillance spyware was tied back to this IP.

It made multiple requests with the same X-Requested-With header.

Multiple requests with the same X-Wap-Profile header.

This IP belongs to Archer-Daniels-Midland.

The IP attempted to perform Integer Overflow attacks on the Apache server.

This IP belongs to Nexon.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

It attempted multiple LDAP injection attacks to gain unauthorized access.

Unusual command line activities that are not typical for the server environment.

This IP belongs to Anthem.

It attempted to perform a Teardrop attack on the SSH server.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

The IP attempted to perform a credential stuffing attack on the IMAP server.

Incidents of privacy-invasive software floating in our network were linked to this IP.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

It attempted to delete directories on the FTP server.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

This IP belongs to World Fuel Services.

HEAD /: May be part of a larger Reconnaissance.

Multiple requests with the same Range header.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

Multiple attempts to access the server using different ports or protocols.