The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

A large number of requests from a single user agent, suggesting an automated process.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

It attempted to send emails with deceptive subject lines from the Postfix server.

It attempted to send emails from the POP3 server without authorization.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

This IP belongs to DigitalOcean.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

The IP attempted to perform a Ping of Death attack on the SSH server.

Unusual patterns in user agent strings.

A large number of requests from a single user agent, suggesting an automated process.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

Multiple requests with the same DNT (Do Not Track) header.

This IP belongs to Boeing.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

The IP attempted to download emails from the POP3 server without authorization.

This IP belongs to Anthem.

The IP address initiated multiple unsuccessful login attempts.

This IP belongs to Nexon.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

This IP belongs to Phillips 66.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.