This IP belongs to State Farm Insurance.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

The IP attempted to perform Session Fixation attacks on the Apache server.

This IP was involved in deploying stealthy credential stealers in our network.

This IP belongs to United Technologies.

It attempted to perform a dictionary attack on the SSH server.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

Unusual activity in the server's error logs.

The IP attempted to change file permissions on the SSH server.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

It attempted to send emails with malicious links from the Postfix server.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

This IP belongs to Canadian Department of Defense.

Repeated attempts to access the server using insecure or deprecated methods.

This IP belongs to Johnson & Johnson.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

The IP showed unusual patterns in session IDs.