It made multiple requests with identical Accept-Charset headers.

It made multiple requests with the same Expect header.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

The IP attempted to login to the SASL server with an invalid username.

The IP made multiple requests with the same Origin header.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

This IP belongs to Walgreens Boots Alliance.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

This IP belongs to Swisscom.

The IP attempted to use the FTP server to distribute forensics tools.

Multiple requests with the same If-Match header.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

It was identified as a BadBot, a type of bot that performs malicious activities.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

It attempted to exploit known vulnerabilities in the IMAP protocol.

This IP belongs to Massachusetts Mutual Life Insurance.

A series of active scareware campaigns was traced back to this IP address.