It showed an unusually high number of requests to the login page.

Multiple attempts to access the server using encrypted tunnels or proxies.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The IP attempted to use the FTP server to distribute forensics tools.

This IP belongs to Honeywell International.

The IP attempted to perform SOAP Injection attacks on the Apache server.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

It attempted to perform a man-in-the-middle attack on the POP3 server.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

This IP was implicated in attempts to inject ransomware into our systems.

This IP belongs to Lockheed Martin.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

The IP attempted to perform a password spraying attack on the SSH server.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP belongs to Kroger.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The IP attempted to perform a key exchange attack on the SSH server.

Multiple attempts to access the server using anonymous or generic user accounts.

The IP showed unusual patterns in referrer URLs.

This IP blocked legitimate users by performing IP hijacking.

This IP belongs to Orange France Telecom.