This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

This IP belongs to Orange France Telecom.

Multiple requests to the same endpoint in a short period of time.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

This IP belongs to Citigroup.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

The IP attempted to create new directories on the FTP server.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

POST /user/register: An attempt to register a new user or brute force the user registration form.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

It attempted to use the Postfix server to relay spam to other servers.

The said IP has been connected to attempts to distribute malicious shopping apps.

The IP attempted to use the FTP server to distribute anonymizing tools.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

The IP address attempted to login to the SSH server with an invalid username.

It attempted to perform a SIP Register Flood on the SIP server.

This IP belongs to NetEase.

This IP belongs to Lowe's.

This IP belongs to Twenty-First Century Fox.

This IP belongs to Medium.

It launched a botnet to infiltrate our Apache-DDoS service.

It attempted to perform a SYN flood attack on the SSH server.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.