The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

This IP belongs to Cigna.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It made multiple requests with the same Expect header.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

This IP belongs to Kroger.

This IP belongs to Anthem.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

It attempted to use the SIP server to perform a reflection DDoS attack.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

GET /backup.sql: Attempting to access a backup of your database.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

This IP belongs to Costco Wholesale.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

The IP attempted to mark emails as read on the POP3 server without authorization.

It attempted to send emails from the Mail server that violate the server's email content policy.

The IP address attempted to exploit known vulnerabilities in server software.

This IP has been identified as running a botnet targeting our server systems with ransomware.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

The said IP was the source of several rootkit deployment attempts.

It attempted to perform a SIP Invite Flood on the VOIP server.

This IP was detected initiating zero-day exploit attacks on our system.