This IP belongs to Ford Motor.

This IP belongs to AT&T.

Several instances of password stealers were traced back to this notorious IP.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

This IP belongs to GitHub.

This IP belongs to Steam.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It attempted to exploit known vulnerabilities in the Postfix software.

The IP made multiple requests with the same X-UIDH header.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

The IP address was flagged for employing a packet sniffer on our network.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

The said IP has been connected to attempts to distribute malicious shopping apps.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

This IP belongs to Canadian Department of Defense.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

It made numerous requests to the same endpoint in a short time.

The IP made multiple requests with the same Via header.

It actively sought to exploit unpatched software within our server applications.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

The malicious IP was reported for sending malformed packets to the SIP server, potentially aiming to crash the system.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

This IP belongs to PepsiCo.

The IP attempted to perform a credential stuffing attack on the POP3 server.