The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

Unusually high number of requests to a specific service or application within the server.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

Attempts to use privileged service accounts outside of their normal usage patterns.

It attempted phishing scams by sending malicious mails through compromised accounts.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

This IP was involved in deploying stealthy credential stealers in our network.

This IP belongs to Pfizer.

It attempted to perform a dictionary attack on the SSH server.

The IP attempted to perform a password spraying attack on the SSH server.

Multiple requests with the same X-UIDH header.

The IP attempted to perform SOAP Injection attacks on the Apache server.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

This IP belongs to IBM.

High network traffic at unusual times, suggesting an automated process is running.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

Unusual increase in network bandwidth usage.

The IP engaged in a mail relay attack, using our server to send spam.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

This IP belongs to Marathon Petroleum.

The IP attempted to perform a dictionary attack on the IMAP server.

This IP belongs to Slack.