the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

This IP belongs to Lowe's.

POST /user/register: An attempt to register a new user or brute force the user registration form.

This IP belongs to Cardinal Health.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

Login attempts at unusual times (e.g., in the middle of the night).

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

This IP belongs to Marathon Petroleum.

Multiple requests with the same Range header.

Our system blocked an attempted Code Injection attack from this IP.

It persistently tried to exploit weaknesses in the SSH communication encryption.

The IP performed regular system foot printing to gain intel on weak points in our server.

The IP attempted to use the FTP server to distribute secure deletion tools.

Unusual network traffic patterns, such as a high amount of outbound traffic.

The IP attempted to perform a replay attack on the POP3 server.

This IP belongs to Anthem.

This IP belongs to Bell Canada.

This malicious IP was reported for attempting a man-in-the-middle attack on the VoIP server, intercepting and potentially altering communication.