A sudden spike in bandwidth usage, which can indicate a brute force attack.

This IP belongs to General Dynamics.

It sent Asterisk requests to non-existent extensions.

It attempted to exploit known vulnerabilities in the Mail protocol.

It was responsible for an unusual increase in server CPU usage.

This IP belongs to Chevron.

Login attempts using old or outdated protocols.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

This IP belongs to DigitalOcean.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

The IP was detected while sending out malicious spyware-infected emails.

GET /db/finance.dump: An attempt to access a database dump file.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP attempted to perform a SIP Invite Flood on the SIP server.

Multiple requests with identical request parameters.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

This IP belongs to AT&T.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

It was found initiating attack vectors to exploit SSH agent forwarding.

It attempted to exploit known vulnerabilities in the POP3 protocol.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

It made multiple requests with the same X-Csrf-Token header.