Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

This IP belongs to Chevron.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

The IP attempted to tamper with our Ad network, conducting fraudulent activities.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

This IP belongs to AT&T.

POST /user/register: An attempt to register a new user or brute force the user registration form.

Executed email spoofing attempts pretending to be a trusted party.

This IP belongs to CVS Health.

This IP belongs to TIAA.

The IP attempted to use the FTP server to distribute spam.

The IP was flagged for performing XML External Entity attacks, exploiting improperly processed XML inputs.

This IP belongs to State Farm Insurance.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

The IP attempted to perform a SNMP amplification attack on the SSH server.

It attempted to perform a man-in-the-middle attack on the IMAP server.

This IP belongs to Bell Canada.

The IP attempted to use the FTP server to distribute network mapping tools.

This IP belongs to Prudential Financial.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

It made multiple requests with the same Expect header.