Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

It appears that this IP was initiating DNSChanger malware attacks on our network.

This IP belongs to CHS.

This IP belongs to Citigroup.

It attempted to login to the SSH server with an invalid password.

This IP belongs to Freddie Mac.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP attempted to perform a replay attack on the IMAP server.

This IP belongs to PepsiCo.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

This IP belongs to 3M.

This IP belongs to Cisco Systems.

Unusual command line activities that are not typical for the server environment.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

The IP attempted to perform a SIP Invite Flood on the SIP server.

It attempted to use the SIP server to perform a reflection DDoS attack.

The IP attempted to perform a replay attack on the POP3 server.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

This IP belongs to Oracle Cloud Infrastructure.

It attempted to delete files from the SSH server.

This IP belongs to TJX.

Our data indicates this IP has performed data breaches by launching phishing attacks.