The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

This IP belongs to Wells Fargo.

This IP belongs to SingTel.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

It attempted to use the FTP server to distribute SQL injection tools.

The IP address was found roaming through the network, scanning for weak spots.

Login attempts that do not follow typical user behavior patterns.

This IP belongs to Medium.

Our system flagged this IP as conducting fraudulent transactions activities.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

Multiple login attempts from different geographical locations in a short period of time.

The IP was involved in a brute force attack on the FTP server, systematically guessing usernames and passwords to gain unauthorized access.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

This IP belongs to PLDT.

The IP attempted to perform Integer Overflow attacks on the Apache server.

It attempted to send emails from the Mail server to a large number of recipients.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

It attempted to use the Postfix server to relay spam to other servers.

Multiple account lockouts in a short period of time.

It attempted to flood the SIP server with REGISTER requests.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.