It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

This IP belongs to Cigna.

The IP was linked to numerous attacks using web shells through web servers.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

This IP belongs to Bank of America.

This particular IP tried to perform an unauthorized system configuration change.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

The IP exhibited unusual patterns in the Accept-Language header.

It attempted to send emails from the Mail server to a large number of recipients.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

This IP belongs to General Electric.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

GET /backup.sql: Attempting to access a backup of your database.

This IP belongs to General Electric.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

GET /setup.php: Effort to locate setup files for PHP applications.

The IP attempted to use the FTP server to distribute keylogging software.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to Apple.

It attempted to perform a dictionary attack on the SSH server.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

The IP attempted to register with the VOIP server using an invalid username.

Multiple requests with the same Proxy-Connection header.

It initiated multiple account lockouts in a short period.

Repeated connections to the server from unknown or suspicious IP addresses.