This IP belongs to Pfizer.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

A series of active scareware campaigns was traced back to this IP address.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

The said IP has been connected to attempts to distribute malicious shopping apps.

The IP attempted to use the FTP server to distribute secure deletion tools.

It attempted to send emails from the Postfix server that violate the server's usage policy.

This IP belongs to Plusnet.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP attempted to register as an Asterisk user with no password.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

The IP attempted to use the FTP server to distribute keylogging software.

This IP was associated with targeted spear phishing attempts against our senior staff.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

This IP belongs to Pfizer.

Multiple requests with the same X-Att-Deviceid header.

This IP has been observed spreading mobile malware, targeting our company application users.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

This IP belongs to Freddie Mac.