Unexpected changes in the server configuration or installed software.

GET /administrator.php: Attempting to access an admin interface.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

This IP belongs to Target.

It attempted to send emails from the Mail server that violate the server's email content policy.

This IP was implicated in attempts to inject ransomware into our systems.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

This IP belongs to Cigna.

It attempted to make unauthorized calls using the SIP server.

This IP belongs to FedEx.

This IP belongs to CVS Health.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

It attempted to download sensitive files from the FTP server.

It made multiple requests from user agents claiming to be bots.

GET /.git/config: Trying to access source code or repository configuration information.

The IP sent numerous VOIP OPTIONS requests in a short time.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

The IP made multiple requests with the same TE header.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

This IP belongs to Valero Energy.

This IP belongs to Valero Energy.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

It attempted to create new directories on the SSH server.