It partook in location spoofing, making it appear from different locations.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

It attempted to delete files from the SSH server.

The IP attempted to send malware-infected attachments from the Mail server.

This IP belongs to Allstate.

This IP belongs to DuPont de Nemours.

Multiple requests with identical request parameters.

It actively sought to exploit unpatched software within our server applications.

It attempted to perform a SIP Register Flood on the SIP server.

The IP was found to be behind numerous fileless malware attacks.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

The IP was involved in a rapid sequence of login attempts.

Unusual increase in server CPU usage.

A majority of our user base received phishing emails originated from this particular IP address.

This IP belongs to Deere.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

The IP attempted to register with the Asterisk server using an invalid username.

The IP address attempted to login to the SSH server with an invalid username.

The IP attempted to exploit known vulnerabilities in the SIP protocol.