The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

It attempted to perform a brute force attack on the POP3 server.

It actively sought to exploit unpatched software within our server applications.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

This IP belongs to United Continental Holdings.

It partook in whaling attacks, specifically targeting high-profile users within our system.

This IP belongs to Kroger.

This IP belongs to Target.

The IP attempted to use the FTP server to distribute VPN tools.

It attempted to send emails with deceptive subject lines from the Postfix server.

Unusual patterns in user agent strings.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

Excessive traffic from a single IP address.

The IP attempted to perform a downgrade attack on the SSH server.

This IP belongs to Proximus.

It attempted to login to the SSH server with an invalid password.

This IP was detected distributing spyware-infected USB drives to our users.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

Unusual system or application errors related to authentication or access controls.

It made multiple requests with the same Range header.

This IP belongs to McKesson.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.