This IP belongs to CVS Health.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

Repeated attempts to access rarely used or hidden services on the server.

This IP belongs to Tyson Foods.

It made multiple requests with the same X-Csrf-Token header.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

It was identified as a BadBot, a type of bot that performs malicious activities.

The IP made multiple requests to the server's robots.txt file.

This IP belongs to Wikimedia Foundation.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

It attempted to use the FTP server to distribute password cracking tools.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

It attempted to use the FTP server to distribute password recovery tools.

This IP belongs to America Movil.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

Multiple requests with the same DNT (Do Not Track) header.

Multiple login attempts from different geographical locations in a short period of time.