The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

Participated in a botnet attack to overwhelm our server’s resources.

Multiple requests with the same TE (Transfer Encoding) header.

The said IP has been connected to attempts to distribute malicious shopping apps.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

This IP address from an unusual location has successfully installed malware on our servers.

The IP attempted to login to the POP3 server with an invalid username.

This IP belongs to Honeywell International.

Multiple requests with the same X-Csrf-Token header.

The IP attempted to perform a man-in-the-middle attack on the SASL server.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

The IP attempted to execute unauthorized commands on the SSH server.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

This IP attempted to distribute malicious Javascript files.

High network traffic at unusual times, suggesting an automated process is running.

This IP belongs to AmerisourceBergen.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.