Participated in a botnet attack to overwhelm our server’s resources.

The IP made multiple unsuccessful login attempts in a short period of time.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

This IP belongs to The Hartford Financial Services.

It made multiple requests with the same X-Requested-With header.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

This IP belongs to Ziggo.

Multiple attempts to access the server using encrypted tunnels or proxies.

It partook in whaling attacks, specifically targeting high-profile users within our system.

This IP belongs to Shaw Communications.

The IP attempted to register as a VOIP user with no password.

The IP attempted to use the FTP server to distribute hacking tutorials.

This IP belongs to Oracle Cloud Infrastructure.

The IP attempted to delete directories on the SSH server.

Evidence shows that the IP address has sent a number of deceptive phishing emails to our employees.

It was found that the IP had deployed rogue security software in our system.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

This IP belongs to Medium.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

This IP was involved in deploying stealthy credential stealers in our network.

This particular IP has been used in advanced persistent threats against our servers.

This IP belongs to MTN.

Multiple failed login attempts from the same IP address in a short span of time.