This IP belongs to Lowe's.

Attempts to use automated scripts or tools for password cracking.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

This IP belongs to Ford Motor.

It attempted to perform a SIPVicious scan on the Asterisk server.

It attempted to make unauthorized calls using the VOIP server.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

It attempted to perform a Teardrop attack on the SSH server.

The IP tried creating false server responses hoping to disrupt the SASL service.

This IP belongs to TJX.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

It made multiple requests from user agents claiming to be bots.

This IP belongs to Dell Technologies.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

This IP belongs to Airtel.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

Multiple requests with identical request parameters.

We observed the IP distributing harmful document tracking tools.

The IP attempted to use the Mail server to relay phishing emails to other servers.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

It attempted to perform a dictionary attack on the SSH server.

Our data revealed this IP distributing malicious powershell scripts.