udden increase in account lockouts due to multiple failed login attempts.

It attempted to exploit known vulnerabilities in the FTP protocol.

Multiple requests with the same Proxy-Authorization header.

This IP belongs to Cigna.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

The IP attempted to create new directories on the FTP server.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

It attempted to perform Command Injection attacks on the Apache server.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

It sent VOIP requests to non-existent extensions.

It attempted to use the FTP server to distribute SQL injection tools.

The reported IP was identified as a BadBot, engaging in harmful activities such as unauthorized web scraping and data mining.

This IP belongs to AmerisourceBergen.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

It attempted to flood the VOIP server with REGISTER requests.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

It attempted to perform a man-in-the-middle attack on the IMAP server.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

It attempted to exploit known vulnerabilities in the IMAP protocol.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

It made multiple requests with the same Range header.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.