It made multiple requests with the same X-Forwarded-For header.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP attempted to perform a Nestea attack on the SSH server.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

This IP belongs to Chevron.

This IP belongs to the University of California, Berkeley.

This IP belongs to Goldman Sachs Group.

The IP attempted to perform a SIP Register Flood on the VOIP server.

The IP was recorded making persistent attempts to crack our encryption.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

Executed email spoofing attempts pretending to be a trusted party.

This IP belongs to DigitalOcean.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

This IP belongs to Comcast.

It attempted to execute unauthorized commands on the Apache server.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.