The said IP has been connected to attempts to distribute malicious shopping apps.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

This IP belongs to GitHub.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP attempted to delete files from the FTP server.

Our data revealed this IP distributing malicious powershell scripts.

This IP belongs to Costco Wholesale.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

It attempted to make unauthorized calls using the SIP server.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

This IP was detected initiating zero-day exploit attacks on our system.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

The IP address attempted to exploit known vulnerabilities in server software.

This IP belongs to NetEase.

The IP attempted to perform a Ping of Death attack on the SSH server.

This IP belongs to TIAA.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

It attempted to use the FTP server to distribute pirated software.

This IP belongs to 3M.

It attempted to use the FTP server to distribute web proxy tools.