This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

This IP belongs to UnitedHealth Group.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

It attempted to make unauthorized calls using the Asterisk server.

Multiple requests with the same Max-Forwards header.

Purposefully tried to clog our mail server's resources by creating a mail loop configuration.

POST /user/register: An attempt to register a new user or brute force the user registration form.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

This particular IP has been used in advanced persistent threats against our servers.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

It persistently tried to exploit weaknesses in the SSH communication encryption.

This IP belongs to FedEx.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

This particular IP has been used in advanced persistent threats against our servers.

Multiple requests with identical POST parameters.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

Multiple requests with the same Proxy-Connection header.

It attempted to use the FTP server to distribute traffic monitoring tools.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.