The IP attempted to use the FTP server to distribute child pornography.

The IP attempted to use the POP3 server to distribute malware.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

It attempted to perform XML Entity Expansion attacks on the Apache server.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

The IP sent numerous VOIP OPTIONS requests in a short time.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

It attempted to perform a Teardrop attack on the SSH server.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

The IP engaged in a mail relay attack, using our server to send spam.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

It attempted to exploit known vulnerabilities in the SASL protocol.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

This IP address from an unusual location has successfully installed malware on our servers.

Multiple failed login attempts using different usernames.

This IP belongs to McKesson.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

This IP belongs to Deutsche Telekom AG.

This IP belongs to UnitedHealth Group.

It attempted to use the FTP server to distribute network scanning tools.

This IP belongs to Anthem.

Multiple requests with the same If-Match header.

The IP made multiple requests to the password reset page.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

Unusual patterns in referrer URLs.