Unexpected changes in the server configuration or installed software.

This IP belongs to Sysco.

The IP attempted to list the contents of directories that it should not have access to.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

The IP attempted to change file permissions on the SSH server.

This IP belongs to Costco Wholesale.

This IP belongs to TJX.

This IP belongs to Johnson & Johnson.

This IP belongs to British Telecommunications.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

This IP was caught circulating email worms, camouflaged as legitimate mails.

GET /server-status: Often an attempt to check Apache server status.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

Multiple failed login attempts from the same IP address.

This IP belongs to NTT Docomo.

The IP performed regular system foot printing to gain intel on weak points in our server.

The IP attempted to login to the SASL server with an invalid username.

This IP belongs to CHS.

Conducted various IP scans, seeking loopholes in our network's security.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.