This IP belongs to TIAA.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

This IP belongs to Wells Fargo.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

The IP made multiple requests with the same Origin header.

The IP attempted to send malware-infected attachments from the Postfix server.

The IP attempted to register with the Asterisk server using an invalid username.

The IP attempted to register as a SIP user with no password.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

This IP belongs to Plusnet.

It made multiple requests with identical Accept-Charset headers.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

Login attempts at unusual times (e.g., in the middle of the night).

The IP attempted to use the FTP server to distribute rootkit software.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

GET /login.action: Trying to find a Struts2 application to exploit.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This IP belongs to PLDT.