It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

This IP belongs to Phillips 66.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

The IP made multiple requests with identical Accept-Encoding headers.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

It attempted to login to the FTP server with an invalid password.

This IP was traced back to several attempts to access domain admin credentials.

Unusual patterns in the sequence of requests.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

This IP belongs to Alibaba Cloud Services.

It tried to execute dictionary attacks on our Mail service causing potential delays.

Multiple requests with the same X-Wap-Profile header.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

It attempted to download sensitive files from the FTP server.

It attempted to perform Command Injection attacks on the Apache server.