This IP attempted to disrupt our systems through the propagation of worms.

This IP belongs to Citigroup.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

It tried to execute dictionary attacks on our Mail service causing potential delays.

It attempted to perform a phishing attack using the POP3 server.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

The IP attempted to use the FTP server to distribute anonymizing tools.

This IP belongs to Orange France Telecom.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

This IP belongs to Nexon.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

This IP belongs to World Fuel Services.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

This IP has been identified as running a botnet targeting our server systems with ransomware.

GET /internal/: Browsing an internal directory.

It attempted to use the FTP server to distribute identity theft tools.

High network traffic at unusual times, suggesting an automated process is running.

It was flagged that this IP had been used in conducting method tampering on our servers.

Multiple failed login attempts using different usernames.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.