Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

It attempted to send emails from the Mail server that violate the server's usage policy.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

It attempted to perform WSDL Enumeration attacks on the Apache server.

This IP belongs to United Technologies.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

GET /backup.sql: Attempting to access a backup of your database.

Attempts to use privileged service accounts outside of their normal usage patterns.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

It tried to execute a Rainbow Table attack, aiming to break the encryption used in SSH password protection.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.

The IP attempted to change file permissions on the SSH server.

It attempted to login to the IMAP server with an invalid password.

This IP belongs to Cigna.

The IP attempted to perform a Kad network amplification attack on the SSH server.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

It attempted to use the SASL server to relay spam.

The IP attempted to send emails with misleading headers from the Postfix server.

It attempted to perform a man-in-the-middle attack on the IMAP server.

This IP was traced back to several attempts to access domain admin credentials.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

Unusual activity in the server's error logs.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.