This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

Repeated attempts to use the same password across multiple accounts.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

Multiple requests with the same Via header.

This IP belongs to DuPont de Nemours.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

This IP has been detected spreading notorious credit card skimmers.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

This IP belongs to Citigroup.

Multiple requests with the same X-Att-Deviceid header.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

This IP directed malicious network traffic to our servers with the intent to crash them.

It attempted to make unauthorized calls using the VOIP server.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

The IP engaged in a mail relay attack, using our server to send spam.

The IP attempted to register with the VOIP server using an invalid username.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

Attempts to access the server using unusual HTTP methods or request types.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

It attempted to perform WSDL Enumeration attacks on the Apache server.