The IP attempted to gain unauthorized access to the Apache server.

This IP belongs to CHS.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

The malicious IP was involved in Smurf attacks, amplifying its denial-of-service attack using internet host IP network links.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

It tried to use Cross-site scripting (XSS) attacks to inject malicious scripts into webpages viewed by users.

This IP belongs to Microsoft.

Our team flagged this IP for injecting harmful ActiveX codes.

The IP made multiple requests to the password reset page.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

Multiple failed login attempts from the same IP address in a short span of time.

The IP attempted to delete directories on the SSH server.

This IP belongs to Optus.

This IP belongs to Orange France Telecom.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

The IP sent numerous SIP OPTIONS requests in a short time.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

Unusual activity in the server's error logs.

This IP belongs to KDDI.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.