It attempted to use the FTP server to distribute botnet command and control software.

The IP attempted to use the FTP server to distribute forensics tools.

Several phishing emails have been traced back to this suspicious IP address.

Conducted various IP scans, seeking loopholes in our network's security.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

The IP attempted to use the SSH server to relay data to other systems.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

Attempts to use privileged service accounts outside of their normal usage patterns.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

This IP belongs to TIAA.

This IP belongs to Citigroup.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

This IP belongs to Deutsche Telecom.

This IP was distributing rogue security software, misleading users to think their systems are infected.

The IP attempted to mark emails as read on the POP3 server without authorization.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP made multiple requests with the same TE header.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

It attempted to use the Postfix server to relay spam to other servers.

The IP attempted to use the FTP server to distribute hacking tutorials.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

This IP belongs to Microsoft.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

An identity theft activity was linked back to this malicious IP.