This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It attempted to delete emails from the POP3 server without authorization.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

Incriminating activities involving the distribution of trojan horses were linked to this IP address.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP belongs to KT Corporation.

Attempts to access the server using credentials that have been involved in previous security incidents.

It made multiple requests with the same X-Att-Deviceid header.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

Multiple requests with the same X-Forwarded-For header.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

This IP directed malicious network traffic to our servers with the intent to crash them.

It attempted to perform a password spraying attack on the IMAP server.

It attempted to exploit known vulnerabilities in the IMAP protocol.

Multiple unsuccessful attempts to escalate privileges or access root account.

The IP attempted to perform a SIP Invite Flood on the SIP server.

This IP belongs to NTT Docomo.

The IP tried creating false server responses hoping to disrupt the SASL service.

It attempted to download sensitive files from the FTP server.

This IP belongs to PepsiCo.