The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

This IP belongs to State Farm Insurance.

It attempted to use the FTP server to relay data to other systems.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

This IP belongs to Wikimedia Foundation.

It attempted to perform a replay attack on the SASL server.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

The IP sent numerous VOIP OPTIONS requests in a short time.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

The IP attempted to delete files from the FTP server.

The IP attempted to list the contents of directories that it should not have access to.

It showed unusual activity in the server's error logs.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

It attempted to perform Race Condition attacks on the Apache server.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

This IP has been observed spreading mobile malware, targeting our company application users.

Executed email spoofing attempts pretending to be a trusted party.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

This IP belongs to Oracle Cloud Infrastructure.

The malicious IP conducted HTTP verb tampering, exploiting varying responses to different HTTP methods.