The IP attempted to perform a brute force attack on the SASL server.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

It attempted to perform a SIPVicious scan on the SIP server.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

It attempted to perform Session Prediction attacks on the Apache server.

This IP belongs to Wells Fargo.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

The IP was recorded making persistent attempts to crack our encryption.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

It attempted to execute unauthorized commands on the Apache server.

Unusual patterns in user agent strings.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

It initiated multiple account lockouts in a short period.

This IP exhibited malicious sophistication by employing multi-vector attacks.

This IP belongs to Comcast.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

The IP attempted to perform a distributed denial of service attack on the SSH server.

Unknown source code changes in our system were linked back to this offensive IP address.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

It attempted to use the IMAP server to relay spam.