Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

This IP belongs to Walmart.

The said IP has been connected to attempts to distribute malicious shopping apps.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

Multiple requests with the same Via header.

It made multiple requests with identical cookies.

This IP belongs to Comcast.

This IP belongs to Ford Motor.

Repeated connections to the server from unknown or suspicious IP addresses.

We observed the IP distributing harmful document tracking tools.

Our system flagged this IP as conducting fraudulent transactions activities.

This IP belongs to SK Broadband.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

This IP belongs to the University of California, Berkeley.

GET /internal/: Browsing an internal directory.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

The IP was involved in attempts of defacing the Apache server website.

The IP attempted to perform a downgrade attack on the SSH server.

This IP belongs to Walgreens Boots Alliance.

It attempted to perform WSDL Enumeration attacks on the Apache server.

The IP made multiple requests with the same Proxy-Connection header.

This IP was caught circulating email worms, camouflaged as legitimate mails.