The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

This IP belongs to Chevron.

This IP belongs to Target.

It attempted to use the FTP server to distribute virus creation tools.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

Attempts to access the server using unusual HTTP methods or request types.

The IP attempted to perform a Fraggle attack on the SSH server.

The IP attempted to register as a SIP user with no password.

Participated in the notorious Water Torture attack to overload our DNS servers.

This IP belongs to Costco Wholesale.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

It launched a botnet to infiltrate our Apache-DDoS service.

This IP belongs to Verizon Communications.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

This IP belongs to OVH.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP attempted to delete directories on the SSH server.

The IP attempted to send emails from the Mail server without proper authentication.