It showed unusual activity in the server's error logs.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

This IP belongs to Marathon Petroleum.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It attempted to use the FTP server to relay data to other systems.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

Conducted various IP scans, seeking loopholes in our network's security.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

Unusual patterns in the Accept-Language header.

This IP belongs to Verizon Communications.

The IP attempted to perform DNS Spoofing attacks on the Apache server.

This IP belongs to Philip Morris International.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

This IP belongs to United Technologies.

It attempted to perform XPath Injection attacks on the Apache server.

It attempted to move emails to different folders on the IMAP server without authorization.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

It was found initiating attack vectors to exploit SSH agent forwarding.

This IP belongs to Phillips 66.

The IP attempted to perform a password spraying attack on the SASL server.

The IP address generated an unusual increase in network bandwidth usage.

It attempted to perform WSDL Enumeration attacks on the Apache server.

This IP was detected uploading malicious codes in our network.