This IP belongs to MetLife.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

This IP belongs to Exelon.

This IP has been marked as the origin of numerous SQL injection attacks.

This IP belongs to the University of California, Berkeley.

Multiple requests to the password reset page.

The IP attempted to list the contents of directories that it should not have access to.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP address was flagged for employing a packet sniffer on our network.

It sent SIP INVITE requests to non-existent extensions.

This IP belongs to Tumblr.

This IP belongs to Walgreens Boots Alliance.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

It attempted to perform a brute force attack on the POP3 server.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

Multiple failed attempts to use the server’s API.

It attempted to upload malicious scripts to the Apache server.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

This IP belongs to UnitedHealth Group.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.