It made multiple requests with identical POST parameters.

This IP belongs to Cardinal Health.

The IP was caught attempting to execute heap overflow attacks.

This IP belongs to Vodafone.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

POST /upload.php: An attempt to upload a possibly malicious file.

GET /.git/config: Trying to access source code or repository configuration information.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

It attempted to exploit known vulnerabilities in the FTP protocol.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

Damaging activities showing connections to rootkit attacks were associated with this IP.

This IP belongs to Procter & Gamble.

The IP address attempted to login to the IMAP server with an invalid username.

The IP attempted to use the FTP server to distribute data recovery tools.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

This IP belongs to UnitedHealth Group.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

The malicious IP was involved in Smurf attacks, amplifying its denial-of-service attack using internet host IP network links.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.