This IP belongs to Mondelez International.

The IP was caught distributing VoIP crackers to exploit our communication channels.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

Multiple requests with the same Range header.

It attempted to perform a brute force attack on the IMAP server.

This IP belongs to Amazon.

The IP attempted to perform a dictionary attack on the IMAP server.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

It attempted to use the FTP server to distribute web proxy tools.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

This IP was detected initiating zero-day exploit attacks on our system.

This IP belongs to Slack.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP attempted to perform Session Fixation attacks on the Apache server.

This IP belongs to The Hartford Financial Services.

This IP belongs to Northwestern Mutual.

This IP belongs to SingTel.

GET /errors.log: Shows an actor trying to access server error logs.

This IP belongs to MetLife.

This IP belongs to CVS Health.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

It tried to execute a Rainbow Table attack, aiming to break the encryption used in SSH password protection.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.