The IP attempted to perform a credential stuffing attack on the IMAP server.

Unusual activity in the server's error logs.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

This IP belongs to WordPress.com.

It made multiple requests with identical POST parameters.

This IP belongs to Caterpillar.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

This IP belongs to CVS Health.

GET /setup.php: Effort to locate setup files for PHP applications.

It attempted to perform XML Entity Expansion attacks on the Apache server.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

The IP tried creating false server responses hoping to disrupt the SASL service.

GET /admin: Looking for an unprotected admin page.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

This IP belongs to Amazon.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

This IP belongs to Citigroup.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

The IP made multiple requests using uncommon HTTP methods.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

It attempted to exploit known vulnerabilities in the FTP protocol.

It was flagged that this IP had been used in conducting method tampering on our servers.

The IP attempted to upload malicious files to the FTP server.