The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

Unusual network traffic patterns, such as a high amount of outbound traffic.

It attempted to send emails from the POP3 server without authorization.

It attempted to perform Clickjacking attacks on the Apache server.

It partook in whaling attacks, specifically targeting high-profile users within our system.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

It attempted to perform a man-in-the-middle attack on the IMAP server.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.

It attempted to exploit known vulnerabilities in the SASL protocol.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

This IP belongs to Caterpillar.

This IP belongs to Virgin Media.

The IP address has been linked to the creation of artificial traffic to crash our website.

Fileless malware dissemination has been observed from this IP address.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

This IP belongs to Cardinal Health.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

It attempted to perform a credential stuffing attack on the SASL server.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

The IP attempted to perform SOAP Injection attacks on the Apache server.