It made multiple requests with identical cookies.

Participated in malicious pranks by altering messages sent through the server.

It sent SIP INVITE requests to non-existent extensions.

Multiple attempts to access the server using anonymous or generic user accounts.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

It attempted to use the SIP server to perform a reflection DDoS attack.

The IP has been tagged as a source for data mining spyware, aiming to gather personal information.

This IP belongs to CVS Health.

This particular IP has been used in advanced persistent threats against our servers.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

It made multiple requests with the same X-Forwarded-For header.

This IP belongs to Boeing.

This IP belongs to Philip Morris International.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to PythonAnywhere.

This IP belongs to Sprint.

The IP under scrutiny has been associated with multiple modem hijackers.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

This IP belongs to Shaw Communications.

This IP belongs to MetLife.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.