The IP attempted to use the Mail server to relay emails with malicious links to other servers.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

This IP belongs to Phillips 66.

It attempted to use the FTP server to distribute SQL injection tools.

It attempted to perform Session Sidejacking attacks on the Apache server.

This IP belongs to Kroger.

The IP made multiple requests with the same Origin header.

This IP belongs to Swisscom.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

This IP belongs to Telkom SA.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

The IP address initiated multiple unsuccessful login attempts.

??????????? ???? ???? ??????? https://fdghfgjq.blogspot.com tC

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

The IP attempted to use the SSH server to relay data to other systems.

The IP address attempted to exploit known vulnerabilities in server software.

The IP attempted to use the FTP server to distribute data recovery tools.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

The IP attempted to use the FTP server to distribute ransomware.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.