Login attempts at unusual times (e.g., in the middle of the night).

This IP belongs to Johnson & Johnson.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.

This particular IP attempted to exploit vulnerabilities in our web applications.

An alarming frequency of microphone loggers has been traced back to this IP.

It made multiple requests with the same Max-Forwards header.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It attempted to create new directories on the SSH server.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

This IP belongs to Baidu.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

This IP belongs to Citigroup.

This IP belongs to the United States Department of Defense.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

This IP belongs to Pfizer.

The IP attempted to use the FTP server to distribute spam.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

The IP attempted to list the contents of directories that it should not have access to.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

The IP made repeated attempts to authenticate with the SIP server using different usernames.