This IP belongs to American Express.

This IP was found responsible for a session hijacking attempt on our network.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

It attempted to perform Session Sidejacking attacks on the Apache server.

It made multiple requests with the same X-Forwarded-For header.

This IP executed mass-probing of various ports to seek vulnerabilities.

Multiple requests with identical Accept-Charset headers.

Unidentified password attempts and login activity were noticed from the specific IP address.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

Rapid sequence of login attempts.

It was identified as a BadBot, a type of bot that performs malicious activities.

This IP belongs to Amazon.

The IP made multiple requests with the same TE header.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP was involved in a rapid sequence of login attempts.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

It was discovered illicitly scanning the server for potential vulnerabilities.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

The IP attempted to use the FTP server to distribute rootkit software.

This IP belongs to Phillips 66.

This IP belongs to CVS Health.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.