The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

The IP attempted to use the FTP server to distribute ransomware.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

It attempted to send emails from the Mail server that violate the server's email content policy.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

This IP belongs to Marathon Petroleum.

It made multiple requests with the same X-Csrf-Token header.

It attempted to send phishing emails from the Mail server.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

This IP was found responsible for a session hijacking attempt on our network.

This IP belongs to The Hartford Financial Services.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

This IP belongs to Softbank.

Excessive traffic from a single IP address.

Our network security detected the IP spreading malicious macros through document files.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

The IP attempted to perform a key exchange attack on the SSH server.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

It attempted to perform a brute force attack on the POP3 server.