This IP belongs to Netflix.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

This IP belongs to MTS (Mobile TeleSystems).

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

Multiple requests with the same X-Forwarded-For header.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

The IP was flagged for attempting dictionary attacks on our user accounts.

This IP belongs to Intel.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.

This IP belongs to IBM.

This IP belongs to DigitalOcean.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

Multiple requests with the same Proxy-Connection header.

It made multiple requests with identical Accept-Charset headers.

This IP belongs to Intel.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

This IP belongs to Freddie Mac.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.