GET /administrator.php: Attempting to access an admin interface.

This IP attempted to disrupt our systems through the propagation of worms.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

It attempted to perform HTTP Parameter Pollution attacks on the Apache server.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

Login attempts that do not follow typical user behavior patterns.

It attempted to flood the SIP server with REGISTER requests.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

This IP belongs to WordPress.com.

The IP attempted to perform a SNMP amplification attack on the SSH server.

The IP performed regular system foot printing to gain intel on weak points in our server.

It made multiple requests with the same Expect header.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

Repeated attempts to use the same password across multiple accounts.

It attempted to use the IMAP server to relay spam.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

A series of unusual file transfers originated from this IP.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

This IP belongs to America Movil.

This IP executed mass-probing of various ports to seek vulnerabilities.