It initiated multiple account lockouts in a short period.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

It made multiple requests with the same X-Forwarded-For header.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

GET /server-status: Often an attempt to check Apache server status.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

This IP belongs to Bank of America.

This IP belongs to Korea Telecom.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

It attempted to perform a password spraying attack on the IMAP server.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

It attempted to use the FTP server to distribute brute force tools.

GET /.git/config: Trying to access source code or repository configuration information.

This IP belongs to KDDI.

Unusual increase in network bandwidth usage.

This IP belongs to Procter & Gamble.

The IP made multiple requests with the same DNT header.

This IP belongs to Wells Fargo.

This IP belongs to Berkshire Hathaway.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

The IP was involved in attempts of defacing the Apache server website.