The IP maliciously used packet sniffers in attempts to decode SSH traffic.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

The IP made multiple requests with the same Via header.

This IP belongs to Vodafone.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

The IP made multiple requests with the same TE header.

The IP was linked to numerous attacks using web shells through web servers.

The IP attempted to perform a timing attack on the SSH server.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

This IP belongs to Orange France Telecom.

This IP belongs to Ford Motor.

This IP belongs to Lowe's.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

The IP was detected while sending out malicious spyware-infected emails.

It showed an unusually high number of requests to the login page.

It sent Asterisk requests to non-existent extensions.

The IP attempted to delete directories on the SSH server.

It attempted to use the SASL server to relay spam.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

Unusual patterns in the sequence of requests.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

The IP attempted to use the FTP server to distribute malware.

The IP was caught attempting to execute heap overflow attacks.

GET /login.action: Trying to find a Struts2 application to exploit.