This IP was implicated in attempts to inject ransomware into our systems.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

The IP address was flagged for employing a packet sniffer on our network.

This IP belongs to Exxon Mobil.

The IP attempted to login to the POP3 server with an invalid username.

This IP belongs to American Express.

Conducted various IP scans, seeking loopholes in our network's security.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

It attempted to use the FTP server to distribute SQL injection tools.

This IP belongs to AmerisourceBergen.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It attempted to delete emails from the IMAP server without authorization.

Multiple requests with identical cookies.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to Archer-Daniels-Midland.