The IP attempted to perform a Kad network amplification attack on the SSH server.

This IP belongs to Procter & Gamble.

This IP belongs to Cloudfare.

This IP belongs to Alphabet.

Repeated attempts to exploit known vulnerabilities in server software.

The IP attempted to use the FTP server to distribute forensics tools.

This IP belongs to JPMorgan Chase.

It attempted to perform a Teardrop attack on the SSH server.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

The IP attempted to mark emails as read on the POP3 server without authorization.

This IP belongs to AT&T.

It made multiple requests with identical Accept-Charset headers.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

It attempted to perform a SSDP amplification attack on the SSH server.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

This IP was linked to an attempt at distributing malicious software within our system.

It attempted to use the FTP server to distribute web proxy tools.

It attempted to perform a brute force attack on the IMAP server.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

This IP belongs to United Parcel Service.

It attempted to send emails from the Postfix server to a large number of recipients.

Repeated attempts to alter or delete log files to cover tracks.