It attempted to perform a RIPv1 amplification attack on the SSH server.

This IP belongs to CVS Health.

This IP belongs to Freddie Mac.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

This IP belongs to Baidu.

This IP belongs to Sony Network Communications.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

It attempted to perform a password spraying attack on the IMAP server.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

It attempted to use the FTP server to distribute terrorist propaganda.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

This IP belongs to MetLife.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

The IP made multiple requests with the same If-Range header.

It tried to execute dictionary attacks on our Mail service causing potential delays.

The IP was detected while sending out malicious spyware-infected emails.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

It initiated multiple account lockouts in a short period.