The IP attempted to send emails with misleading headers from the Mail server.

This IP belongs to General Electric.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

We flagged down attempts from the IP to leak backdoor viruses into the system.

This IP belongs to Vkontakte.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

The IP attempted to perform a QOTD amplification attack on the SSH server.

The IP attempted to use the FTP server to distribute credit card fraud tools.

The IP attempted to perform a password spraying attack on the SSH server.

This IP was detected initiating zero-day exploit attacks on our system.

This IP belongs to WordPress.com.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

This IP belongs to Marathon Petroleum.

It attempted to execute unauthorized commands on the Apache server.

The IP attempted to use the POP3 server to distribute malware.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

This IP belongs to American Airlines Group.

This IP belongs to 3M.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

The IP attempted to use the FTP server to distribute data recovery tools.

It attempted to perform a dictionary attack on the SASL server.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

Multiple requests with the same Expect header.