This IP belongs to KT Corporation.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

The IP address was flagged for employing a packet sniffer on our network.

This IP belongs to Facebook.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

Multiple requests with the same Max-Forwards header.

Multiple attempts to access the server using different ports or protocols.

It attempted to use the FTP server to distribute traffic monitoring tools.

Multiple requests with the same Warning header.

This IP belongs to Sysco.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP performed regular system foot printing to gain intel on weak points in our server.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

The IP attempted to perform Format String attacks on the Apache server.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

It attempted to use the POP3 server to relay phishing emails.

Repeated attempts to access rarely used or hidden services on the server.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.