Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

We identified the IP address as a source of numerous scare tactics spyware.

This IP belongs to Marathon Petroleum.

It attempted to perform a Smurf attack on the SSH server.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

The IP made multiple requests with identical Accept-Encoding headers.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

It attempted to exploit known vulnerabilities in the SASL protocol.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

The IP attempted to perform Session Fixation attacks on the Apache server.

The IP was found to be behind numerous fileless malware attacks.

This IP belongs to Exelon.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

Our system blocked an attempted Code Injection attack from this IP.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

Unknown source code changes in our system were linked back to this offensive IP address.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The IP address generated an unusual increase in network bandwidth usage.

This IP was implicated in attempts to inject ransomware into our systems.