This IP belongs to Bank of America.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

Unusual patterns in user agent strings.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

This IP belongs to Fannie Mae.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

This IP was implicated in attempts to inject ransomware into our systems.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

The IP attempted to perform a downgrade attack on the SSH server.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It attempted to perform a Newtear attack on the SSH server.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

Multiple requests with the same X-Wap-Profile header.

This IP belongs to World Fuel Services.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.