The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

This IP belongs to Sprint.

The IP attempted to use the POP3 server to distribute malware.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

This IP belongs to American Express.

Multiple attempts to access the server using different ports or protocols.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This IP belongs to Cox Communications.

This IP belongs to Target.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

This IP was detected initiating zero-day exploit attacks on our system.

The IP attempted to use the FTP server as a proxy for other malicious activities.

It attempted to send emails with deceptive subject lines from the Postfix server.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

This IP blocked legitimate users by performing IP hijacking.

This IP belongs to Costco Wholesale.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

The IP attempted to perform a Bonk attack on the SSH server.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

This IP belongs to Phillips 66.