Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

It attempted to download sensitive files from the FTP server.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

Attempts to use privileged service accounts outside of their normal usage patterns.

This IP belongs to NTT Docomo.

This IP belongs to Alibaba Cloud Services.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

This IP belongs to Cigna.

This IP belongs to Abbott Laboratories.

The IP attempted to send malware-infected attachments from the Postfix server.

This IP belongs to Rogers Cable.

This IP has been observed spreading mobile malware, targeting our company application users.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

It attempted to send phishing emails from the Postfix server.

This IP belongs to World Fuel Services.

This IP belongs to Canadian Department of Defense.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

Our system flagged the IP for injecting malicious script into benign pages through the man-in-the-browser attack.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

It attempted to perform Race Condition attacks on the Apache server.