It executed directory traversal attempts to access unauthorized directories / folders in our server.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP attempted to upload malicious files to the FTP server.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

It attempted to use the SSH server as a proxy for other malicious activities.

It attempted to use the FTP server to distribute SQL injection tools.

This IP belongs to Freddie Mac.

This IP belongs to Comcast.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.

It attempted to perform a phishing attack using the IMAP server.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

It showed an unusually high number of requests to the login page.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The IP attempted to use the FTP server to distribute VPN tools.

It attempted to perform a SYN flood attack on the SSH server.

The IP attempted to perform ARP Spoofing attacks on the Apache server.

This IP belongs to PepsiCo.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

A series of unusual file transfers originated from this IP.

This IP belongs to Home Depot.

The IP made multiple requests with identical Accept-Encoding headers.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.