The IP attempted to use the POP3 server to distribute malware.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP attempted to use the Mail server to relay phishing emails to other servers.

This IP belongs to IBM Cloud Services.

The IP attempted to perform XML Injection attacks on the Apache server.

It attempted to login to the FTP server with an invalid password.

GET /vuln.html: Looking for any page vulnerabilities.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The IP address was found roaming through the network, scanning for weak spots.

This IP was implicated in attempts to inject ransomware into our systems.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

This IP belongs to DigitalOcean.

The IP's involvement in spreading password stealers has compromised our network's protection.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

This IP was detected uploading malicious codes in our network.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

The IP made multiple requests to the password reset page.

This IP belongs to IBM Cloud Services.

Multiple failed login attempts from the same IP address.

This IP belongs to Lockheed Martin.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.