It attempted to use the FTP server to distribute wireless cracking tools.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

It attempted to use the POP3 server to relay phishing emails.

This IP belongs to Citigroup.

This IP belongs to the University of California, Berkeley.

Our logs indicated an unusually high traffic volume originating from this IP address.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

This IP belongs to United Technologies.

The IP made multiple requests with identical Accept-Encoding headers.

It attempted to perform Race Condition attacks on the Apache server.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

The IP had been flagged for initiating SYN flood attacks on our servers.

It attempted to perform Session Prediction attacks on the Apache server.

This IP was traced back to several attempts to access domain admin credentials.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

This IP belongs to Sprint.

The IP attempted to gain unauthorized access to the Apache server.

GET /administrator.php: Attempting to access an admin interface.

It attempted to perform Race Condition attacks on the Apache server.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

This IP belongs to Telkom SA.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

It attempted to upload malicious scripts to the Apache server.