It attempted to execute unauthorized commands on the Apache server.

The IP attempted to perform SOAP Injection attacks on the Apache server.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

The IP attempted to use the FTP server to distribute hacking tutorials.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

This IP belongs to Gilead Sciences.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

It attempted to perform a session hijacking attack on the SSH server.

The IP attempted to send emails from the Mail server without proper authentication.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

This IP belongs to Kroger.

It attempted to take advantage of misconfigurations in the Apache server.

The IP was detected while sending out malicious spyware-infected emails.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

The IP was detected while sending out malicious spyware-infected emails.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

This IP belongs to McKesson.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.