The IP was involved in a Directory Traversal attack, attempting to access restricted directories and files.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

The IP address has been associated with unwanted browser toolbar installations.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

This IP belongs to Bank of America.

This IP address from an unusual location has successfully installed malware on our servers.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

This IP belongs to Marathon Petroleum.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

This IP belongs to Freddie Mac.

This IP belongs to Telus Communications.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

This IP belongs to Bell Canada.

This IP belongs to United Continental Holdings.

This IP belongs to Exelon.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

This IP directed malicious network traffic to our servers with the intent to crash them.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

This IP belongs to General Electric.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

The IP made multiple requests with the same Proxy-Authorization header.

This IP belongs to Vkontakte.