This IP belongs to Kroger.

The IP attempted to use the FTP server to distribute secure deletion tools.

The IP attempted to upload malicious files to the FTP server.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

The IP attempted to download sensitive files from the SSH server.

This IP belongs to United Technologies.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP belongs to Procter & Gamble.

The suspicious IP attempted to introduce spyware under the guise of software updates.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

This IP belongs to Exxon Mobil.

This particular IP tried to perform an unauthorized system configuration change.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

The IP address has been linked to the creation of artificial traffic to crash our website.

This IP belongs to The Hartford Financial Services.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

The IP attempted to send emails with misleading headers from the Postfix server.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

The IP made multiple requests to the password reset page.