This IP belongs to Comcast.

The IP made multiple requests with the same Origin header.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

The malicious IP was reported for sending malformed packets to the SIP server, potentially aiming to crash the system.

Repeated attempts to access the server using insecure or deprecated methods.

It attempted to perform a SIPVicious scan on the SIP server.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

The IP was noted for executing SYN flood attacks, purposefully creating half-open connections to deplete server resources.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

This IP belongs to Chevron.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

This IP belongs to Gilead Sciences.

The IP attempted to perform a replay attack on the SSH server.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

This malicious IP was reported for attempting a Zero-day exploit, exploiting a software vulnerability before it's known or fixed by the vendor.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

The IP has been implicated in multiple cases of URL manipulation attempts.

The IP attempted to perform a replay attack on the IMAP server.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

Microsoft account got stolen by them

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.