This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

Repeated attempts to exploit known vulnerabilities in server software.

This IP belongs to Fannie Mae.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

The IP was caught trying to overload the server through a Distributed Denial of Service attack.

A large number of requests from a single user agent, suggesting an automated process.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

It was involved in a Distributed Denial of Service (DDoS) attack.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

GET /server-status: Often an attempt to check Apache server status.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

This IP belongs to Bristol-Myers Squibb.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP attempted to perform a Nestea attack on the SSH server.

It attempted to send emails with malicious links from the Mail server.

Our network security detected the IP spreading malicious macros through document files.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

It attempted to login to the IMAP server with an invalid password.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

The IP has been implicated in multiple cases of URL manipulation attempts.