It sent Asterisk requests to non-existent extensions.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

This IP belongs to Liberty Mutual Insurance Group.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

Participated in a botnet attack to overwhelm our server’s resources.

It attempted to perform a man-in-the-middle attack on the IMAP server.

This IP belongs to FedEx.

This IP belongs to Phillips 66.

POST /admin/upload.php?_upl: An attempt to exploit the JQuery File Upload vulnerability.

A series of unusual file transfers originated from this IP.

This IP belongs to DuPont de Nemours.

It attempted to exploit known vulnerabilities in the IMAP protocol.

The IP made multiple requests with the same If-Range header.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

The malicious IP was reported for sending malformed packets to the SIP server, potentially aiming to crash the system.

The IP attempted to login to the SASL server with an invalid username.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

This IP belongs to United Technologies.

The IP attempted to use the SASL server to relay phishing emails.

This IP belongs to Marathon Petroleum.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.