It attempted to perform Heap Overflow attacks on the Apache server.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

Unusual patterns in the sequence of requests.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

It attempted to use the POP3 server to relay phishing emails.

This IP belongs to Optus.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

This IP belongs to Citigroup.

Repeated failed attempts to perform actions that require higher privileges.

This IP belongs to Shopify.

This IP belongs to FedEx.

The IP address attempted to register as a SIP user with an invalid username.

This IP belongs to Fannie Mae.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

The IP attempted to send malware-infected attachments from the Postfix server.

The IP attempted to use the FTP server to distribute child pornography.

The IP attempted to create new directories on the FTP server.

It attempted to perform a SIPVicious scan on the SIP server.

This IP belongs to Freddie Mac.

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

This IP belongs to GitHub.