This IP belongs to Hong Kong Broadband Network.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

It tried to execute dictionary attacks on our Mail service causing potential delays.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

The IP attempted to perform a Bonk attack on the SSH server.

Attempts to access the server using credentials that have been involved in previous security incidents.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

This IP belongs to MetLife.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

A majority of our user base received phishing emails originated from this particular IP address.

This IP belongs to Alphabet.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

It attempted to perform Web Service attacks on the Apache server.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

It appears that this IP was initiating DNSChanger malware attacks on our network.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

The IP attempted to download emails from the POP3 server without authorization.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.