The IP performed regular system foot printing to gain intel on weak points in our server.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

The IP sent numerous Asterisk OPTIONS requests in a short time.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

It attempted to use the FTP server to distribute hacking tools.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

This IP belongs to Korea Telecom.

This IP belongs to Valero Energy.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

Login attempts at unusual times (e.g., in the middle of the night).

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

This IP belongs to FedEx.

This IP belongs to Cisco Systems.

It attempted to use the FTP server to distribute network scanning tools.

This IP belongs to Marathon Petroleum.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.