It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

Attempts to access the server using stolen or leaked credentials.

This IP belongs to Procter & Gamble.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

This IP belongs to Jabil.

This IP belongs to Philip Morris International.

This IP belongs to NTT Docomo.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It attempted to use the VOIP server to perform a reflection DDoS attack.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

It was responsible for an unusual increase in server CPU usage.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

This IP belongs to Tech Data.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

It attempted to use the FTP server to distribute encryption tools.

This IP belongs to DuPont de Nemours.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

It attempted to use the SSH server as a proxy for other malicious activities.

The IP attempted to use the FTP server to distribute ransomware.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.