Our team flagged this IP for injecting harmful ActiveX codes.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

This IP directed malicious network traffic to our servers with the intent to crash them.

This IP belongs to Wells Fargo.

This IP belongs to Slack.

The IP attempted to perform Format String attacks on the Apache server.

The IP attempted to perform a distributed denial of service attack on the SSH server.

Attempts to use privileged service accounts outside of their normal usage patterns.

It sent VOIP requests to non-existent extensions.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

Unusual increase in server CPU usage.

It attempted to send emails from the POP3 server without authorization.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Multiple requests with the same Proxy-Connection header.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

Our network security detected the IP spreading malicious macros through document files.

It attempted to change file permissions on the FTP server.