This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

It made multiple requests with the same Range header.

It attempted to perform a Steam protocol amplification attack on the SSH server.

The suspicious IP attempted to introduce spyware under the guise of software updates.

It made multiple requests with identical POST parameters.

This IP belongs to Johnson & Johnson.

It attempted to send phishing emails from the Postfix server.

This IP belongs to Oracle.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

This IP belongs to McKesson.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

Attempts to use privileged service accounts outside of their normal usage patterns.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

This IP belongs to Dow Chemical.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

The IP was involved in attempts of defacing the Apache server website.

This IP belongs to WordPress.com.

This IP made wrongful manipulations indicating the operation of malicious downgrader.

It attempted to delete emails from the POP3 server without authorization.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

The IP attempted to login to the Postfix server with an invalid username.

This IP belongs to New York Life Insurance.