This IP belongs to Ford Motor.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

The IP attempted to perform a replay attack on the SSH server.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

This IP was detected distributing spyware-infected USB drives to our users.

This IP belongs to PythonAnywhere.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

It attempted to perform a denial of service attack on the SSH server.

This IP belongs to Kroger.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

The IP made multiple requests with the same Proxy-Authorization header.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

This IP has been identified as running a botnet targeting our server systems with ransomware.

This IP belongs to Caterpillar.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

This IP belongs to Lowe's.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

The IP attempted to gain unauthorized access to the Apache server.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

It attempted to login to the SSH server with an invalid password.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.