This IP has been identified as running a botnet targeting our server systems with ransomware.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

This IP belongs to FedEx.

The IP attempted to perform a SIPVicious scan on the VOIP server.

It attempted to perform a dictionary attack on the SSH server.

Multiple attempts to access the server using different ports or protocols.

This IP belongs to Kroger.

This IP belongs to Alphabet.

The IP attempted to use the Mail server to relay spam to other servers.

This IP belongs to General Electric.

Executed email spoofing attempts pretending to be a trusted party.

The IP attempted to use the FTP server to distribute VPN tools.

This IP belongs to Cisco Systems.

The IP made multiple requests to the password reset page.

It attempted to perform a session hijacking attack on the SSH server.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

It attempted to make unauthorized calls using the VOIP server.

It attempted to use the FTP server to distribute wireless cracking tools.

The IP attempted to perform XML Injection attacks on the Apache server.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

A sudden spike in bandwidth usage, which can indicate a brute force attack.