Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP belongs to PepsiCo.

This particular IP has been used in advanced persistent threats against our servers.

Spammers

GET /../htpasswd: Trying to access password files using directory traversal.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Multiple requests with the same Proxy-Authorization header.

It attempted to perform a Sentinels amplification attack on the SSH server.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

Damaging activities showing connections to rootkit attacks were associated with this IP.

This IP belongs to Publix Super Markets.

Multiple requests with the same X-Wap-Profile header.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

This IP belongs to Caterpillar.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

POST /upload.php: An attempt to upload a possibly malicious file.

This IP belongs to Phillips 66.

It actively sought to exploit unpatched software within our server applications.

It sent VOIP requests to non-existent extensions.

It was responsible for an unusual increase in server CPU usage.

It attempted to use the FTP server to store illegal content.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.