This IP belongs to Northwestern Mutual.

This IP belongs to Nationwide.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

This IP belongs to Cox Communications.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

A dangerous data surveillance spyware was tied back to this IP.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

The IP address has been associated with unwanted browser toolbar installations.

It attempted to perform a brute force attack on the POP3 server.

The IP attempted to download emails from the IMAP server without authorization.

This IP belongs to United Technologies.

It sent SIP INVITE requests to non-existent extensions.

High network traffic at unusual times, suggesting an automated process is running.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

Multiple failed login attempts using different usernames.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

It attempted to perform a password spraying attack on the IMAP server.

We identified the IP address as a source of numerous scare tactics spyware.

The IP attempted to perform a replay attack on the IMAP server.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

It attempted to perform a Teardrop attack on the SSH server.

This IP belongs to MTN.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.