It attempted to use the FTP server to distribute traffic monitoring tools.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

The IP made multiple unsuccessful login attempts in a short period of time.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The IP made multiple requests using uncommon HTTP methods.

Rapid sequence of login attempts.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

GET /admin: Looking for an unprotected admin page.

It attempted to perform a Steam protocol amplification attack on the SSH server.

It was found initiating attack vectors to exploit SSH agent forwarding.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

This IP belongs to Microsoft Azure.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

It attempted to use the FTP server to distribute virus creation tools.

It attempted to upload malicious scripts to the Apache server.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

This IP belongs to Apple.

It attempted to create new directories on the SSH server.

The IP made multiple requests with the same DNT header.

The IP was caught distributing VoIP crackers to exploit our communication channels.

This IP belongs to Best Buy.

The IP attempted to perform Directory Traversal attacks on the Apache server.