The IP address made multiple requests with identical request parameters.

The IP attempted to perform a SIP Register Flood on the VOIP server.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

The IP attempted to use the FTP server as a proxy for other malicious activities.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

This IP belongs to Johnson & Johnson.

This IP was accused of multiple unauthorized removal of security certificates.

The IP made multiple requests to the server's robots.txt file.

It attempted to perform a session hijacking attack on the SSH server.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This IP was associated with targeted spear phishing attempts against our senior staff.

This IP belongs to MTN.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

This IP belongs to Archer-Daniels-Midland.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

The IP was found to be behind numerous fileless malware attacks.

It attempted to use the SASL server to distribute malware.

This IP belongs to Exxon Mobil.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

This IP attempted to distribute malicious Javascript files.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

Multiple requests with the same X-UIDH header.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.