Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

A dangerous data surveillance spyware was tied back to this IP.

The IP made multiple requests with the same If-Match header.

This IP was accused of multiple unauthorized removal of security certificates.

The IP made multiple requests with the same DNT header.

The IP address has been linked to the creation of artificial traffic to crash our website.

This IP belongs to Home Depot.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

This IP belongs to UnitedHealth Group.

This IP belongs to Verizon.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

It attempted to login to the SASL server with an invalid password.

Multiple login attempts from different geographical locations in a short period of time.

The IP attempted to perform DNS Spoofing attacks on the Apache server.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

This IP belongs to FedEx.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

This IP belongs to Microsoft.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

This IP belongs to Berkshire Hathaway.