It attempted to perform Buffer Overflow attacks on the Apache server.

This IP belongs to United Parcel Service.

This IP belongs to Canadian Department of Defense.

It attempted to perform a SSDP amplification attack on the SSH server.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

Unusual command line activities that are not typical for the server environment.

This IP belongs to Cloudfare.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

Our team discovered that specific IP was distributing intrusive cookie trackers.

This IP belongs to Microsoft Azure.

The IP attempted to gain unauthorized access to the Apache server.

This IP belongs to 3M.

This IP belongs to Fannie Mae.

Incidents of privacy-invasive software floating in our network were linked to this IP.

It attempted to use the FTP server to distribute web proxy tools.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

This IP belongs to Marathon Petroleum.

Damaging activities showing connections to rootkit attacks were associated with this IP.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.