The IP attempted to use the FTP server to distribute zero-day exploit tools.

It attempted to perform a Teardrop attack on the SSH server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

This IP belongs to Cloudfare.

It attempted to use the FTP server to distribute identity theft tools.

This IP belongs to Bank of America.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

This IP attempted to distribute malicious Javascript files.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

It attempted to use the FTP server to distribute wireless cracking tools.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

The IP attempted to use the FTP server as a proxy for other malicious activities.

This IP belongs to Costco Wholesale.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

The IP attempted to create new directories on the FTP server.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

The IP sent numerous Asterisk OPTIONS requests in a short time.

Unusual patterns in referrer URLs.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

It attempted to perform a dictionary attack on the SSH server.

The IP attempted to download emails from the POP3 server without authorization.

Evidence shows that the IP address has sent a number of deceptive phishing emails to our employees.

The IP made multiple requests with the same If-Range header.