FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP attempted to use the POP3 server to relay spam.

Multiple attempts to access the server using anonymous or generic user accounts.

It attempted to perform a side channel attack on the SSH server.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

This IP address from an unusual location has successfully installed malware on our servers.

Our data revealed this IP distributing malicious powershell scripts.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

It attempted to change file permissions on the FTP server.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

An identity theft activity was linked back to this malicious IP.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

The IP attempted to use the FTP server to distribute rootkit software.

It made numerous requests to the same endpoint in a short time.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

This IP belongs to Nike.

The IP was involved in a traffic flooding attack, overwhelming a network's bandwidth to cause service disruption.

It attempted to perform a password spraying attack on the POP3 server.