The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

This IP belongs to Phillips 66.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

This IP belongs to PepsiCo.

The IP attempted to perform Session Replay attacks on the Apache server.

Login attempts at unusual times (e.g., in the middle of the night).

The IP attempted to login to the Postfix server with an invalid username.

The IP attempted to send spam emails from the Mail server.

The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

This IP belongs to Travelers Cos.

Multiple requests to the password reset page.

Repeated attempts to alter or delete log files to cover tracks.

This IP belongs to Alphabet.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

It attempted to perform a Sentinels amplification attack on the SSH server.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

This IP belongs to Amazon.

A dangerous data surveillance spyware was tied back to this IP.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.