The IP tried to perform a cross-site request forgery attack on the IMAP service.

This IP belongs to Nexon.

The IP attempted to perform Session Replay attacks on the Apache server.

The IP engaged in a mail relay attack, using our server to send spam.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.

The IP was linked to numerous attacks using web shells through web servers.

The IP attempted to send malware-infected attachments from the Postfix server.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

It tried to execute dictionary attacks on our Mail service causing potential delays.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

This IP belongs to Sony Network Communications.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

This IP was caught circulating email worms, camouflaged as legitimate mails.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

It attempted to perform a RIPv1 amplification attack on the SSH server.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

Attempts to access the server using credentials that have been involved in previous security incidents.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP attempted to login to the Postfix server with an invalid username.

It attempted to perform XPath Injection attacks on the Apache server.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

This IP belongs to Deutsche Telekom AG.