The IP attempted to perform Directory Traversal attacks on the Apache server.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

This IP was accused of multiple unauthorized removal of security certificates.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

The IP attempted to use the Mail server to relay spam to other servers.

Multiple attempts to access the server using different ports or protocols.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

The IP attempted to perform Session Hijacking attacks on the Apache server.

The suspicious IP attempted to introduce spyware under the guise of software updates.

This IP belongs to World Fuel Services.

It made multiple requests with the same X-Att-Deviceid header.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

This IP belongs to Comcast.

It attempted to perform a SIP Register Flood on the Asterisk server.

It attempted to use the FTP server to distribute network scanning tools.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

A majority of our user base received phishing emails originated from this particular IP address.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

This IP belongs to Alibaba Cloud Services.

This IP belongs to MetLife.