It attempted to perform a Steam protocol amplification attack on the SSH server.

This IP belongs to Goldman Sachs Group.

Unusual activity in the server's error logs.

Unusual patterns in the Accept-Language header.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

The IP attempted to perform a downgrade attack on the SSH server.

This IP has been marked as the origin of numerous SQL injection attacks.

It made multiple requests from user agents claiming to be bots.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

It launched a botnet to infiltrate our Apache-DDoS service.

This IP belongs to Archer-Daniels-Midland.

This IP belongs to Fannie Mae.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

Our team has linked several viruses dissemination activities to this IP.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

It attempted to send emails from the Mail server that violate the server's usage policy.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.

It made numerous requests to the same endpoint in a short time.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

Repeated attempts to access the server using insecure or deprecated methods.

It attempted to use the FTP server to distribute identity theft tools.