It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

Multiple requests with the same X-UIDH header.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

It attempted to perform a password spraying attack on the POP3 server.

This IP belongs to United Continental Holdings.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

The IP attempted to send spam emails from the Postfix server.

It attempted phishing scams by sending malicious mails through compromised accounts.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to 3M.

It attempted to send emails from the Postfix server to a large number of recipients.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

This IP belongs to Netflix.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

The IP attempted to send malware-infected attachments from the Mail server.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

Frequent password reset requests.

It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

Rapid sequence of login attempts.