The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

This IP belongs to Phillips 66.

It attempted to list the contents of directories that it should not have access to.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

This IP belongs to Virgin Media.

Multiple requests with identical POST parameters.

Multiple requests with the same Expect header.

This IP belongs to McKesson.

This IP belongs to Walmart.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

Unusual patterns in referrer URLs.

It was observed attempting to exploit known vulnerabilities in the IMAP protocol.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It attempted to perform Command Injection attacks on the Apache server.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

This IP belongs to GoDaddy.

The malicious IP was reported for sending malformed packets to the SIP server, potentially aiming to crash the system.

Login attempts using old or outdated protocols.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

A series of unusual file transfers originated from this IP.

The IP attempted to send emails from the Mail server to blacklisted email addresses.