Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

This IP belongs to Exelon.

This IP belongs to Sysco.

This IP belongs to Citigroup.

It launched a botnet to infiltrate our Apache-DDoS service.

This IP belongs to Johnson & Johnson.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

It partook in location spoofing, making it appear from different locations.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

The IP attempted to perform ARP Spoofing attacks on the Apache server.

The IP attempted to use the FTP server to distribute secure deletion tools.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

A series of unusual file transfers originated from this IP.

The IP attempted to send emails from the Mail server without proper authentication.

It attempted to use the VOIP server to perform a reflection DDoS attack.

It made numerous requests to the same endpoint in a short time.

Multiple requests with the same X-Requested-With header.

This IP belongs to Cardinal Health.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

This IP belongs to Procter & Gamble.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

It tried to execute dictionary attacks on our Mail service causing potential delays.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.