This IP belongs to Liberty Mutual Insurance Group.

Unexpected changes in the server configuration or installed software.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

The IP attempted to flood the Apache server with requests, in a Denial of Service (DoS) attack.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

The IP attempted to mark emails as read on the IMAP server without authorization.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

It attempted to perform a brute force attack on the POP3 server.

The IP attempted to use the FTP server to distribute rootkit software.

It attempted to use the FTP server to distribute terrorist propaganda.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

This IP was linked to an attempt at distributing malicious software within our system.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

The IP attempted to perform Session Hijacking attacks on the Apache server.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

The IP attempted to login to the Postfix server with an invalid username.

The IP attempted to login to the Postfix server with an invalid username.

The IP attempted to perform a password spraying attack on the SSH server.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.