DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

This IP belongs to Orange France Telecom.

It attempted to perform IP Spoofing attacks on the Apache server.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

Attempts to use privileged service accounts outside of their normal usage patterns.

This IP belongs to CVS Health.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

This IP belongs to the United States Department of Defense.

It attempted to create new directories on the SSH server.

It made multiple requests with identical Accept-Charset headers.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

Multiple requests with the same Range header.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

It attempted to use the SASL server to relay spam.

This IP belongs to Anthem.

This IP belongs to Chevron.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

This IP belongs to UnitedHealth Group.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

Multiple requests with identical Accept-Encoding headers.