This IP belongs to American Airlines Group.

This IP was involved in deploying stealthy credential stealers in our network.

The IP attempted to send emails from the IMAP server without authorization.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

This IP belongs to Valero Energy.

The IP attempted to perform Directory Traversal attacks on the Apache server.

This IP belongs to BT Central Plus.

This IP was involved in deploying stealthy credential stealers in our network.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

The IP performed regular system foot printing to gain intel on weak points in our server.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

The malicious IP was involved in a SPIT (Spam over IP Telephony) attack, sending unsolicited messages over the VoIP server.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

The IP attempted to change file permissions on the SSH server.

The IP attempted logins at unusual times.

The IP attempted to perform Session Replay attacks on the Apache server.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.