The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

This IP belongs to Medium.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

Multiple requests with the same Proxy-Authorization header.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

This IP belongs to Microsoft.

This IP belongs to Ubisoft.

It attempted to use the IMAP server to relay spam.

This IP belongs to Steam.

The IP attempted to perform Session Fixation attacks on the Apache server.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

This IP belongs to Nintendo.

This IP belongs to Bristol-Myers Squibb.

Participated in the notorious Water Torture attack to overload our DNS servers.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

It sent SIP INVITE requests to non-existent extensions.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

This IP belongs to Northwestern Mutual.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

This IP belongs to CVS Health.

The IP attempted to use the FTP server to distribute rootkit software.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.