The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

The IP attempted to use the FTP server to distribute ransomware.

A series of active scareware campaigns was traced back to this IP address.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

This IP belongs to Exxon Mobil.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

Purposefully tried to clog our mail server's resources by creating a mail loop configuration.

This IP belongs to Honeywell International.

GET /.git/config: Trying to access source code or repository configuration information.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

The IP has been traced back to system monitors, aiming to watch and record user activity.

The IP attempted to create new directories on the FTP server.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

This IP belongs to Verizon Communications.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.

It attempted to perform a NTP amplification attack on the SSH server.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

The IP address initiated multiple unsuccessful login attempts.