This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP belongs to Steam.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

This IP belongs to FedEx.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

The IP attempted to list the contents of directories that it should not have access to.

We observed the IP distributing harmful document tracking tools.

Multiple requests with identical Accept-Encoding headers.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

This IP belongs to Walgreens Boots Alliance.

This IP belongs to Intel.

Unusually high number of requests to a specific service or application within the server.

This IP belongs to Mondelez International.

It conducted an incursion on secure shell (SSH), attempting to tamper with encrypted data.

It attempted to use the FTP server to store illegal content.

GET /configuration.php.old: Trying to locate backup configuration files.

It attempted to use the FTP server to distribute zombie network tools.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

It made multiple requests with the same X-Wap-Profile header.

It attempted to perform IP Spoofing attacks on the Apache server.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

This IP was responsible for circulating malicious images masked with spyware.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.