It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP belongs to Verizon Communications.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

An alarming frequency of microphone loggers has been traced back to this IP.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

The IP attempted to use the POP3 server to distribute malware.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

This IP belongs to Marathon Petroleum.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

This IP belongs to GoDaddy.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

Multiple requests with the same Range header.

Multiple requests with the same Warning header.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

It attempted to use the FTP server to distribute botnet command and control software.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

It attempted to login to the Postfix server with an invalid password.