The IP attempted to use the SSH server to relay data to other systems.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

This IP attempted to disrupt our systems through the propagation of worms.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

This IP belongs to General Electric.

This IP belongs to Ziggo.

GET /server-status: Often an attempt to check Apache server status.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

The IP has initiated several exploits, specifically for software vulnerabilities.

The suspicious IP attempted to introduce spyware under the guise of software updates.

The IP attempted to perform a SIP Register Flood on the VOIP server.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP attempted to upload malicious files to the FTP server.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

This IP belongs to Abbott Laboratories.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

The IP attempted to perform a password spraying attack on the SASL server.

This IP was traced back to several attempts to access domain admin credentials.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.