Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP address attempted to login to the SSH server with an invalid username.

Multiple requests with the same X-UIDH header.

Multiple requests with identical Accept-Encoding headers.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

The IP attempted to send emails from the Postfix server without proper authentication.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

The IP attempted to use the FTP server to distribute hacking tutorials.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

This IP belongs to Gilead Sciences.

This IP belongs to Bank of America.

The IP was involved in attempts of defacing the Apache server website.

The IP attempted to register as a VOIP user with no password.

It attempted to exploit known vulnerabilities in the SSH protocol.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

This IP belongs to Apple.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

We identified the IP address as a source of numerous scare tactics spyware.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.