This IP belongs to Humana.

The IP attempted to use the FTP server to distribute DDoS attack tools.

We observed the IP distributing harmful document tracking tools.

It attempted to send emails with deceptive subject lines from the Mail server.

GET /vuln.html: Looking for any page vulnerabilities.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

This IP was traced back to several attempts to access domain admin credentials.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It attempted to perform a SIP Register Flood on the Asterisk server.

This IP belongs to DuPont de Nemours.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

It attempted to perform Heap Overflow attacks on the Apache server.

This IP belongs to United Continental Holdings.

Our network security detected the IP spreading malicious macros through document files.

This IP belongs to Heroku.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

This IP was associated with targeted spear phishing attempts against our senior staff.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

Unusual activity in the server's error logs.

We observed the IP distributing harmful document tracking tools.

It attempted to delete emails from the IMAP server without authorization.

This IP belongs to Boeing.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.