The IP attempted to use the FTP server to distribute anonymizing tools.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

This IP was detected initiating zero-day exploit attacks on our system.

This IP belongs to Walgreens Boots Alliance.

It attempted to use the FTP server to distribute brute force tools.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

Repeated attempts to alter or delete log files to cover tracks.

The IP attempted to perform a Kad network amplification attack on the SSH server.

Frequent password reset requests.

Multiple requests with the same If-Range header.

The IP attempted to perform a SIP Register Flood on the VOIP server.

It was identified as a BadBot, a type of bot that performs malicious activities.

It sent VOIP requests to non-existent extensions.

This IP belongs to Humana.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

It attempted to make unauthorized calls using the SIP server.

The IP attempted to send emails from the Mail server without proper authentication.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

Unusual patterns in the Accept-Language header.

It persistently tried to exploit weaknesses in the SSH communication encryption.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

The IP attempted to mark emails as read on the IMAP server without authorization.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.