The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

This IP belongs to America Movil.

It attempted to send emails from the Mail server that violate the server's usage policy.

It attempted to perform a SIPVicious scan on the Asterisk server.

This IP belongs to Canadian Department of Defense.

It was identified as a BadBot, a type of bot that performs malicious activities.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

This IP belongs to Vodafone.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It attempted to perform XML Entity Expansion attacks on the Apache server.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

Fileless malware dissemination has been observed from this IP address.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Multiple unsuccessful attempts to escalate privileges or access root account.

It attempted to perform a Smurf attack on the SSH server.

The IP was noted for executing SYN flood attacks, purposefully creating half-open connections to deplete server resources.

It attempted to move emails to different folders on the IMAP server without authorization.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

It attempted to perform Buffer Overflow attacks on the Apache server.

This IP belongs to Caterpillar.

Our firewall recorded intrusion attempts originating from this suspicious IP.