The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

It attempted to perform a Smurf attack on the SSH server.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

The IP attempted to perform a brute force attack on the SASL server.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

Finally, the IP was caught in the act of Abandoned Object attacks, creating objects with no reference to exhaust memory space

It made multiple requests with identical POST parameters.

Multiple requests with the same If-Match header.

This IP belongs to Vodacom.

The IP attempted to upload malicious files to the FTP server.

It attempted multiple LDAP injection attacks to gain unauthorized access.

The IP attempted to send emails from the IMAP server without authorization.

This IP belongs to Bank of America.

This IP belongs to Home Depot.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

It attempted to flood the Asterisk server with REGISTER requests.

This IP belongs to Johnson & Johnson.

This IP belongs to Walmart.

The IP attempted to perform a phishing attack using the SASL server.

Multiple requests with the same Referer header.

It attempted to use the SASL server to relay spam.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.