It attempted to use the FTP server to distribute SQL injection tools.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

This IP belongs to Amazon.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

The IP attempted to brute force the password to gain mail account access.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

This IP has been observed spreading mobile malware, targeting our company application users.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

It attempted to exploit known vulnerabilities in the POP3 protocol.

This IP belongs to Amazon.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

This IP belongs to Intel.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

The IP exhibited unusual patterns in the Accept-Language header.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

It launched invasive malware to corrupt crucial segments of our server functionality.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

The IP engaged in a mail relay attack, using our server to send spam.

An identity theft activity was linked back to this malicious IP.

The IP sent numerous SIP OPTIONS requests in a short time.

Repeated attempts to access rarely used or hidden services on the server.

HEAD /: May be part of a larger Reconnaissance.