It attempted to send emails from the Mail server to a large number of recipients.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

Unusual patterns in the Accept-Language header.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

It attempted to delete directories on the FTP server.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

This IP belongs to Exelon.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

This IP belongs to Cisco Systems.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

The IP made multiple requests with the same If-Range header.

Attempts to access the server using credentials that have been involved in previous security incidents.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

It appears that this IP was initiating DNSChanger malware attacks on our network.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

It conducted an incursion on secure shell (SSH), attempting to tamper with encrypted data.