The IP attempted to perform a QOTD amplification attack on the SSH server.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

Multiple requests with the same Warning header.

The IP address has been involved in distributing adware to our server systems.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

This IP belongs to Pfizer.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

The IP attempted to perform a password spraying attack on the SASL server.

It seems like this IP tried to spread malware into the network.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

It attempted to perform HTTP Parameter Pollution attacks on the Apache server.

It attempted to send emails with deceptive subject lines from the Mail server.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

The IP attempted to register with the VOIP server using an invalid username.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

This IP belongs to MetLife.

This IP belongs to Phillips 66.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

This IP belongs to Steam.

It attempted to perform a SSDP amplification attack on the SSH server.

The IP was found trying to maliciously clone the SSH certificates for privileged access.