A majority of our user base received phishing emails originated from this particular IP address.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

This IP belongs to Walmart.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

Participated in a botnet attack to overwhelm our server’s resources.

It attempted to perform a Teardrop attack on the SSH server.

It attempted to perform a brute force attack on the POP3 server.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

This IP belongs to PLDT.

It attempted to perform a RIPv1 amplification attack on the SSH server.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

GET /errors.log: Shows an actor trying to access server error logs.

This IP belongs to Virgin Media.

The IP attempted to perform a Bonk attack on the SSH server.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

It attempted to perform a SIP Register Flood on the Asterisk server.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

This IP belongs to Cardinal Health.

GET /configuration.php.old: Trying to locate backup configuration files.

It attempted to use the IMAP server to relay spam.

This IP was detected uploading malicious codes in our network.

It partook in whaling attacks, specifically targeting high-profile users within our system.