The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

This IP belongs to Target.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

It was found initiating attack vectors to exploit SSH agent forwarding.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

This IP belongs to The Hartford Financial Services.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This IP belongs to Swisscom.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

The IP attempted to perform a replay attack on the POP3 server.

This IP belongs to Bristol-Myers Squibb.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

It attempted to use the Postfix server to relay spam to other servers.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

This IP belongs to SingTel.

The IP attempted to mark emails as read on the IMAP server without authorization.

This IP belongs to Lowe's.

GET /login.action: Trying to find a Struts2 application to exploit.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.