Our data revealed this IP distributing malicious powershell scripts.

A large number of requests from a single user agent, suggesting an automated process.

It showed unusual patterns in the sequence of requests.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.

Multiple failed login attempts from the same IP address in a short span of time.

It attempted to send phishing emails from the Mail server.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

This IP belongs to Globe Telecom.

This IP belongs to IBM.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

This IP belongs to Anthem.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

The IP was noted for executing SYN flood attacks, purposefully creating half-open connections to deplete server resources.

The IP attempted to use the FTP server to distribute malware.

The IP attempted to send emails from the Mail server without proper authentication.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

It attempted to login to the IMAP server with an invalid password.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

The IP made multiple requests with the same X-UIDH header.

The IP attempted to execute unauthorized commands on the SSH server.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.