Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

This IP belongs to PLDT.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

Several instances of aggressive advertising spyware have been linked to this IP.

The IP attempted to use the FTP server to distribute network mapping tools.

The IP attempted to download sensitive files from the Apache server.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

It attempted to use the FTP server to distribute virus creation tools.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

Our firewall recorded intrusion attempts originating from this suspicious IP.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

It attempted to perform a SSDP amplification attack on the SSH server.

It showed an unusually high number of requests to the login page.

It attempted to perform a SSDP amplification attack on the SSH server.

It was found initiating attack vectors to exploit SSH agent forwarding.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

It made multiple requests with the same X-Requested-With header.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

Multiple requests with the same X-Att-Deviceid header.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

It attempted to send phishing emails from the Postfix server.