This IP belongs to Cigna.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP attempted to use the FTP server to distribute rootkit software.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

The IP made multiple requests with the same If-Range header.

It attempted to flood the Asterisk server with REGISTER requests.

It attempted to delete emails from the IMAP server without authorization.

It attempted to exploit known vulnerabilities in the FTP protocol.

This IP belongs to the University of California, Berkeley.

The IP sent numerous SIP OPTIONS requests in a short time.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

The IP attempted to perform a password spraying attack on the SASL server.

This IP belongs to CVS Health.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

Our system flagged this IP as conducting fraudulent transactions activities.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

The IP made multiple requests with the same If-Match header.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

The IP attempted to use the FTP server to distribute spam.