The IP attempted to flood the Apache server with requests, in a Denial of Service (DoS) attack.

The IP sent numerous SIP OPTIONS requests in a short time.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

It attempted to perform a credential stuffing attack on the SASL server.

Multiple requests with identical Accept-Encoding headers.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

The IP performed regular system foot printing to gain intel on weak points in our server.

The IP attempted to use the FTP server to distribute credit card fraud tools.

This IP belongs to Xbox Live.

The IP engaged in a mail relay attack, using our server to send spam.

The IP attempted to perform a dictionary attack on the POP3 server.

The IP made multiple unsuccessful login attempts in a short period of time.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

GET /login.action: Trying to find a Struts2 application to exploit.

It attempted to use the FTP server to distribute phishing emails.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

The IP made multiple requests with the same Origin header.

It attempted to use the FTP server to distribute zombie network tools.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.