GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

Participated in a botnet attack to overwhelm our server’s resources.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP attempted to execute unauthorized commands on the SSH server.

This IP belongs to Optus.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

It attempted to delete directories on the FTP server.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

It attempted to perform XPath Injection attacks on the Apache server.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

This IP belongs to Alphabet.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

It attempted to perform Web Service attacks on the Apache server.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.

The IP has initiated several exploits, specifically for software vulnerabilities.

The IP attempted to use the FTP server to distribute secure deletion tools.

It made multiple requests with the same If-None-Match header.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

It tried to execute dictionary attacks on our Mail service causing potential delays.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.