The IP attempted to use the FTP server to distribute secure deletion tools.

This IP blocked legitimate users by performing IP hijacking.

It attempted to perform a man-in-the-middle attack on the SSH server.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

The IP has been tagged as a source for data mining spyware, aiming to gather personal information.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

The IP made multiple requests to the password reset page.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

It attempted to perform a RIPv1 amplification attack on the SSH server.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

This IP belongs to UnitedHealth Group.

This IP belongs to MetLife.

The malicious IP conducted HTTP verb tampering, exploiting varying responses to different HTTP methods.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

It partook in whaling attacks, specifically targeting high-profile users within our system.

A series of active scareware campaigns was traced back to this IP address.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

It attempted to use the POP3 server to relay phishing emails.

This IP has been observed spreading mobile malware, targeting our company application users.

POST /upload.php: An attempt to upload a possibly malicious file.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

It attempted to perform a password spraying attack on the IMAP server.