The IP was engaged in port scanning, probing the server for open SSH ports.

This IP belongs to Hostgator.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

It launched invasive malware to corrupt crucial segments of our server functionality.

It attempted to send phishing emails from the Postfix server.

GET /configuration.php.old: Trying to locate backup configuration files.

The IP made multiple requests using uncommon HTTP methods.

It attempted to make unauthorized calls using the Asterisk server.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

This IP belongs to Alphabet.

The IP address initiated multiple unsuccessful login attempts.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

This IP belongs to Bristol-Myers Squibb.

Attempts to access the server using stolen or leaked credentials.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

Multiple failed login attempts from the same IP address.

This IP belongs to MTS (Mobile TeleSystems).

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.