The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

It attempted to send emails from the POP3 server without authorization.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Multiple requests with the same Proxy-Connection header.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

Our network security detected the IP spreading malicious macros through document files.

This IP belongs to Walgreens Boots Alliance.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

This IP belongs to Humana.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

The IP initiated dictionary attacks, hoping to guess the correct password combination.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

It attempted to flood the VOIP server with REGISTER requests.

It attempted to perform a phishing attack using the IMAP server.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.