It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

The IP attempted to use the FTP server to distribute keylogging software.

This IP attempted to distribute malicious Javascript files.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

This IP belongs to Alphabet.

It attempted to flood the Asterisk server with REGISTER requests.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

This IP belongs to Allstate.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

It attempted to use the FTP server to distribute phishing emails.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

The IP was flagged for attempting dictionary attacks on our user accounts.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

This IP belongs to Lowe's.

This IP has been identified as running a botnet targeting our server systems with ransomware.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

This IP belongs to JPMorgan Chase.

Our team discovered that specific IP was distributing intrusive cookie trackers.

It attempted to use the Postfix server to relay phishing emails to other servers.

Unusual patterns in the sequence of requests.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.