The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

The IP attempted to perform a Bonk attack on the SSH server.

The IP attempted to perform a man-in-the-middle attack on the SASL server.

It attempted to use the FTP server to distribute network scanning tools.

It attempted to send emails with malicious links from the Postfix server.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

The IP sent numerous VOIP OPTIONS requests in a short time.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

The IP attempted to use the FTP server to distribute spam.

The IP made multiple requests using uncommon HTTP methods.

The IP attempted to perform a Nestea attack on the SSH server.

It attempted to send emails with deceptive subject lines from the Postfix server.

This IP belongs to McKesson.

It partook in location spoofing, making it appear from different locations.

It made multiple requests with the same X-Att-Deviceid header.

Unusual command line activities that are not typical for the server environment.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

This IP was found responsible for a session hijacking attempt on our network.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

This IP belongs to McKesson.

It attempted to send emails with malicious links from the Mail server.