Unusually high CPU usage, which can indicate a brute force attack is in progress.

The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

It attempted to perform a SIP Register Flood on the Asterisk server.

It attempted to perform a session hijacking attack on the SSH server.

This IP belongs to Nationwide.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

It attempted command injection attacks, hoping to execute unauthorized commands.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

Multiple unsuccessful attempts to escalate privileges or access root account.

Several cross-site scripting attacks were traced back to this IP.

This IP belongs to IBM Cloud Services.

This particular IP tried to perform an unauthorized system configuration change.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

Frequent password reset requests.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Login attempts using old or outdated protocols.

This IP belongs to Valero Energy.

This IP belongs to Proximus.