The IP attempted to perform a man-in-the-middle attack on the SASL server.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

It attempted to delete directories on the FTP server.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

It attempted to create new directories on the SSH server.

The IP attempted to use the FTP server to distribute malware.

The IP attempted to use the SASL server to relay phishing emails.

Login attempts at unusual times (e.g., in the middle of the night).

The IP was involved in a rapid sequence of login attempts.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

The IP attempted to mark emails as read on the POP3 server without authorization.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

It attempted to perform a Sentinels amplification attack on the SSH server.

This IP belongs to Dell Technologies.

The IP showed unusual patterns in session IDs.

It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

This IP belongs to Cisco Systems.

This IP belongs to Cardinal Health.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.