It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

Our network security detected the IP spreading malicious macros through document files.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

This IP belongs to World Fuel Services.

It attempted to use the VOIP server to perform a reflection DDoS attack.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

This IP belongs to JPMorgan Chase.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

The IP attempted to perform a dictionary attack on the IMAP server.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

This particular IP has been used in advanced persistent threats against our servers.

Unknown source code changes in our system were linked back to this offensive IP address.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

This IP belongs to Medium.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

The IP made multiple requests with the same TE header.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This IP belongs to Phillips 66.

The IP address was found roaming through the network, scanning for weak spots.

Unusual command line activities that are not typical for the server environment.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.