It attempted to use the SSH server as a proxy for other malicious activities.

It attempted to perform a RIPv1 amplification attack on the SSH server.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

This IP belongs to Hong Kong Broadband Network.

It attempted to use the FTP server to distribute pirated software.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.

It attempted to login to the SASL server with an invalid password.

It attempted to login to the IMAP server with an invalid password.

The IP attempted to perform a replay attack on the IMAP server.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

The IP attempted to perform a SIP Register Flood on the VOIP server.

This IP belongs to State Farm Insurance.

Repeated attempts to alter or delete log files to cover tracks.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It attempted to use the FTP server to store illegal content.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

The IP attempted to list the contents of directories that it should not have access to.