This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

This IP belongs to Cardinal Health.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

It engaged in a click fraud operation using our server’s communication channels.

This particular IP attempted to exploit vulnerabilities in our web applications.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

The IP attempted to perform a SIPVicious scan on the VOIP server.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

This IP was detected initiating zero-day exploit attacks on our system.

The IP was linked to numerous attacks using web shells through web servers.

This IP was associated with targeted spear phishing attempts against our senior staff.

It attempted to perform a Steam protocol amplification attack on the SSH server.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

It attempted to exploit known vulnerabilities in the POP3 protocol.

This IP was caught conducting cookie-poisoning attack.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

This IP belongs to Travelers Cos.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

It was involved in a Distributed Denial of Service (DDoS) attack.