It attempted to perform a SYN flood attack on the SSH server.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

Our firewall recorded intrusion attempts originating from this suspicious IP.

This IP belongs to Berkshire Hathaway.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

A multitude of spyware-infected download wrappers were linked to the spotted IP address.

The IP made multiple requests with the same If-Range header.

This IP belongs to Vodafone.

Several instances of password stealers were traced back to this notorious IP.

Multiple requests with the same X-Forwarded-For header.

It attempted to use the FTP server to distribute web proxy tools.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

The IP made multiple requests with identical Accept-Encoding headers.

The IP attempted to delete files from the FTP server.

This IP belongs to Dreamhost.

This IP belongs to Comcast.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

The IP was detected attempting to skirt our system's detection through spoofing.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

This IP belongs to Rogers Cable.

GET /login.action: Trying to find a Struts2 application to exploit.

It attempted to use the FTP server to distribute password recovery tools.

The IP exhibited unusual patterns in the Accept-Language header.