The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

It showed unusual activity in the server's error logs.

The IP address was found roaming through the network, scanning for weak spots.

This IP belongs to Kroger.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

It attempted to move emails to different folders on the IMAP server without authorization.

GET /configuration.php.old: Trying to locate backup configuration files.

This IP belongs to Lowe's.

The IP attempted to list the contents of directories that it should not have access to.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

It attempted to flood the VOIP server with REGISTER requests.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

A series of active scareware campaigns was traced back to this IP address.

This IP belongs to the United States Department of Defense.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

It attempted to perform a denial of service attack on the SSH server.

This IP belongs to SK Broadband.

Our system blocked an attempted Code Injection attack from this IP.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

Multiple requests with the same Expect header.