This IP was traced back to several attempts to access domain admin credentials.

Multiple failed login attempts using different usernames.

The IP showed unusual patterns in referrer URLs.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP was caught conducting cookie-poisoning attack.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

It made multiple requests with the same If-None-Match header.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

It attempted to perform a SIP Invite Flood on the VOIP server.

This IP belongs to Canadian Department of Defense.

This IP belongs to Microsoft.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The IP attempted to list the contents of directories that it should not have access to.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

The IP address was found roaming through the network, scanning for weak spots.

This IP belongs to Alphabet.

This IP belongs to AT&T.

A majority of our user base received phishing emails originated from this particular IP address.

It attempted to use the POP3 server to relay phishing emails.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

A majority of our user base received phishing emails originated from this particular IP address.

The IP attempted to use the FTP server to distribute steganography tools.

Excessive traffic from a single IP address.