This IP was associated with targeted spear phishing attempts against our senior staff.

It seems like this IP tried to spread malware into the network.

It attempted to send emails from the Mail server that violate the server's email content policy.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

The IP was detected while sending out malicious spyware-infected emails.

This IP belongs to Comcast.

This IP was responsible for circulating malicious images masked with spyware.

It attempted to use the VOIP server to perform a reflection DDoS attack.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

It attempted to perform a Teardrop attack on the SSH server.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

The IP attempted to perform a Nestea attack on the SSH server.

Login attempts using old or outdated protocols.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

This IP belongs to Honeywell International.