This IP belongs to Boeing.

This IP belongs to Shaw Communications.

It attempted to use the VOIP server to perform a reflection DDoS attack.

The IP attempted to perform a dictionary attack on the IMAP server.

Participated in the notorious Water Torture attack to overload our DNS servers.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

It made multiple requests with identical POST parameters.

The IP attempted to perform a SNMP amplification attack on the SSH server.

Unknown source code changes in our system were linked back to this offensive IP address.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This IP belongs to Verizon Communications.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

The IP attempted to perform a key exchange attack on the SSH server.

It seems like this IP tried to spread malware into the network.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The IP's involvement in spreading password stealers has compromised our network's protection.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

It attempted to perform Clickjacking attacks on the Apache server.