It sent Asterisk requests to non-existent extensions.

It attempted to perform a dictionary attack on the SASL server.

This IP belongs to United Technologies.

This IP belongs to Cardinal Health.

This IP belongs to Cigna.

This IP belongs to Bristol-Myers Squibb.

This IP belongs to World Fuel Services.

This IP blocked legitimate users by performing IP hijacking.

Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

The IP was recorded making persistent attempts to crack our encryption.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

This IP belongs to Bank of America.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It attempted to use the FTP server to distribute identity theft tools.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

Repeated connections to the server from unknown or suspicious IP addresses.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

Multiple requests with identical POST parameters.

It attempted to send emails with malicious links from the Mail server.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

It attempted to perform a RIPv1 amplification attack on the SSH server.