This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

The malicious IP tried to depreciate the reputation of our mail server by sending out numerous spam mails.

The IP was detected while sending out malicious spyware-infected emails.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

The said IP has been connected to attempts to distribute malicious shopping apps.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

The IP sent numerous VOIP OPTIONS requests in a short time.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

Attempts to access the server using unusual HTTP methods or request types.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

The IP was flagged for attempting dictionary attacks on our user accounts.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

It attempted to delete directories on the FTP server.

Unusual network traffic patterns, such as a high amount of outbound traffic.

The IP was involved in a brute force attack on the FTP server, systematically guessing usernames and passwords to gain unauthorized access.

It initiated requests to non-existent endpoints.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

This IP belongs to KDDI.

The IP attempted to perform a Nestea attack on the SSH server.

This IP belongs to World Fuel Services.