Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

The IP attempted to use the FTP server to distribute hacking tutorials.

Repeated attempts to access the server using insecure or deprecated methods.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

The IP tried to crack S/MIME encryption for accessing secured email contents.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

This IP belongs to Nike.

This IP has been observed spreading mobile malware, targeting our company application users.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to 3M.

The IP attempted to use the FTP server to distribute data recovery tools.

This IP belongs to Telstra.

The IP was involved in a traffic flooding attack, overwhelming a network's bandwidth to cause service disruption.

Participated in malicious pranks by altering messages sent through the server.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

The IP attempted to use the FTP server to distribute rootkit software.

This IP belongs to Heroku.

This IP was associated with targeted spear phishing attempts against our senior staff.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.