This IP made wrongful manipulations indicating the operation of malicious downgrader.

Repeated attempts to exploit known vulnerabilities in server software.

Numerous incidents of botnet infestations were traced back to this offensive IP address.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP attempted to register as an Asterisk user with no password.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

It made multiple requests with the same Expect header.

It attempted to perform IP Spoofing attacks on the Apache server.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

This IP belongs to Telstra.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

GET /setup.php: Effort to locate setup files for PHP applications.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

The IP attempted to perform a SIP Register Flood on the VOIP server.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It made multiple requests with the same Range header.

This IP belongs to General Electric.

It launched a botnet to infiltrate our Apache-DDoS service.

It attempted to use the FTP server to distribute network scanning tools.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.