This IP belongs to McKesson.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

The IP attempted to register as an Asterisk user with no password.

This IP belongs to Cigna.

This IP attempted to distribute malicious Javascript files.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

This IP belongs to Vodafone.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

This IP belongs to Dreamhost.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

The IP attempted to mark emails as read on the POP3 server without authorization.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

GET /server-status: Often an attempt to check Apache server status.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

A majority of our user base received phishing emails originated from this particular IP address.

The IP attempted to use the FTP server to distribute rootkit software.

Login attempts using old or outdated protocols.

It attempted to use the SSH server as a proxy for other malicious activities.

This IP belongs to AmerisourceBergen.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.