The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

This IP belongs to MetLife.

This IP belongs to Cigna.

Multiple requests with the same Max-Forwards header.

This IP belongs to Anthem.

The IP made multiple requests with the same Warning header.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

Our team has linked several viruses dissemination activities to this IP.

I just noticed some weird login attempts showing up in my email header last night it looks like someone is trying to brute force their way in. The timestamps dont add up and the domain looks off. Cant shake the feeling that my accounts got brushed with a hacked server somewhere. If anyone else sees strange entries like this its probably best to change your passwords asap. Honestly got me checking every security setting again cause this stuff is creepy.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

This IP belongs to Fannie Mae.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

The IP mounted HTTP Parameter Pollution attacks, disrupting server processes by injecting adulterated parameters.

It made multiple requests with the same Max-Forwards header.

This IP belongs to Telefonica Spain.

It attempted to send emails with malicious links from the Mail server.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

The IP attempted reconnaissance activities, trying to footprint our server’s network.