This IP belongs to Deere.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

Unusual system or application errors related to authentication or access controls.

The IP tried creating false server responses hoping to disrupt the SASL service.

This IP belongs to PLDT.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

Ukraine

Novyny

An alarming frequency of microphone loggers has been traced back to this IP.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

This IP belongs to Freddie Mac.

GET /administrator.php: Attempting to access an admin interface.

This IP belongs to Walmart.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

The IP made multiple requests with the same Origin header.

This IP was detected uploading malicious codes in our network.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The IP made multiple requests with the same Warning header.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

This IP belongs to Boeing.

This IP belongs to Nike.

This IP addressed employed a method of brute force attack attempting to compromise our systems.