It was involved in a Distributed Denial of Service (DDoS) attack.

The IP attempted to perform a credential stuffing attack on the POP3 server.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP belongs to Lowe's.

It attempted to download sensitive files from the FTP server.

It attempted to exploit known vulnerabilities in the IMAP protocol.

The IP has been tagged as a source for data mining spyware, aiming to gather personal information.

This IP was traced back to several attempts to access domain admin credentials.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

This particular IP has been used in advanced persistent threats against our servers.

The IP attempted to use the SSH server to relay data to other systems.

The IP attempted to use the POP3 server to relay spam.

This IP belongs to Gilead Sciences.

The IP attempted to use the FTP server to distribute hacking tutorials.

Unusual patterns in session IDs.

The IP attempted to use the FTP server as a proxy for other malicious activities.

This IP belongs to ConocoPhillips.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

This IP belongs to Costco Wholesale.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

It attempted to perform a NTP amplification attack on the SSH server.

This IP belongs to SingTel.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.