It attempted to use the FTP server to distribute wireless cracking tools.

This IP belongs to McKesson.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

The IP address initiated attacks using DDoS, impacting our server response times.

It attempted to send emails with malicious links from the Mail server.

This IP belongs to United Parcel Service.

It sent VOIP requests to non-existent extensions.

This IP belongs to Telkom SA.

The IP attempted to use the FTP server to distribute network mapping tools.

Multiple requests with the same X-Att-Deviceid header.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It actively sought to exploit unpatched software within our server applications.

It attempted to perform a SIPVicious scan on the SIP server.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

This IP belongs to Nike.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

Unusual increase in network bandwidth usage.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

The IP made multiple requests with the same Proxy-Connection header.

The IP tried to crack S/MIME encryption for accessing secured email contents.

This IP belongs to Charter Communications.

The IP attempted to perform a credential stuffing attack on the POP3 server.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

This IP was detected distributing spyware-infected USB drives to our users.

This IP was traced back to several attempts to access domain admin credentials.