This IP attempted to disrupt our systems through the propagation of worms.

The IP showed unusual patterns in session IDs.

The IP attempted to perform XML Injection attacks on the Apache server.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

This IP belongs to Costco Wholesale.

This IP belongs to Johnson & Johnson.

This IP belongs to Walgreens Boots Alliance.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

This IP belongs to AmerisourceBergen.

The IP attempted to login to the SASL server with an invalid username.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

This IP belongs to Orange France Telecom.

Unusual patterns in the Accept-Language header.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

The IP made multiple requests with the same Proxy-Authorization header.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

Our records indicate the IP spread multiple executable infector spyware causing system malfunction.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

It attempted to flood the VOIP server with REGISTER requests.

The IP attempted to register as a SIP user with no password.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

It attempted to perform WSDL Enumeration attacks on the Apache server.