The IP attempted to login to the Postfix server with an invalid username.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

It attempted to make unauthorized calls using the VOIP server.

This IP has been marked as the origin of numerous SQL injection attacks.

This IP belongs to Nationwide.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

Unusual patterns in user agent strings.

This IP belongs to Kraft Heinz.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

The IP attempted to download sensitive files from the Apache server.

GET /db/finance.dump: An attempt to access a database dump file.

The IP address has been linked to the creation of artificial traffic to crash our website.

The IP was traced back to stealthy installation attempts of clipboard monitors.

The IP address initiated attacks using DDoS, impacting our server response times.

The IP attempted to perform Symlink attacks on the Apache server.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

This IP belongs to Hong Kong Broadband Network.

An identity theft activity was linked back to this malicious IP.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.