It attempted to perform a Teardrop attack on the SSH server.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

Unusually high number of requests to the login page.

Multiple requests with the same X-Att-Deviceid header.

This IP belongs to Swisscom.

The IP made multiple requests with the same X-UIDH header.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

This IP belongs to Morgan Stanley.

It attempted to list the contents of directories that it should not have access to.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

The IP attempted to perform a DNS amplification attack on the SSH server.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

It attempted to login to the POP3 server with an invalid password.

The IP attempted to send spam emails from the Mail server.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

This IP belongs to Marathon Petroleum.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

This IP belongs to Amazon.

GET /.git/config: Trying to access source code or repository configuration information.