GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

Repeated failed attempts to perform actions that require higher privileges.

It sent VOIP requests to non-existent extensions.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

The IP made multiple requests with the same Via header.

The IP has initiated several exploits, specifically for software vulnerabilities.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

This IP belongs to Travelers Cos.

This IP belongs to Chevron.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

It engaged in a click fraud operation using our server’s communication channels.

The IP attempted to register as a SIP user with no password.

A series of unusual file transfers originated from this IP.

The IP attempted to mark emails as read on the IMAP server without authorization.

This IP belongs to PepsiCo.

This IP belongs to Time Warner Cable Internet.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

The IP address initiated attacks using DDoS, impacting our server response times.

It attempted to send emails with malicious links from the Postfix server.

This IP belongs to Cisco Systems.

This IP belongs to Anthem.

The IP under scrutiny has been associated with multiple modem hijackers.