This IP belongs to Walgreens Boots Alliance.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

The IP attempted to perform Session Hijacking attacks on the Apache server.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

It was found initiating attack vectors to exploit SSH agent forwarding.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

This IP belongs to Medium.

GET /setup.php: Effort to locate setup files for PHP applications.

This IP belongs to Fannie Mae.

The IP attempted to use the FTP server to distribute DDoS attack tools.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

The IP showed unusual patterns in referrer URLs.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

It made numerous requests to the same endpoint in a short time.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

This IP belongs to Sony Network Communications.

The IP address attempted to register as a SIP user with an invalid username.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

This IP belongs to TJX.

This IP belongs to Comcast.

This IP has been flagged for attempting to escalate privileges in our network.