Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

It attempted logins using outdated protocols.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

This IP belongs to Humana.

The IP attempted to perform a replay attack on the IMAP server.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

This IP belongs to AmerisourceBergen.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

Our team discovered that specific IP was distributing intrusive cookie trackers.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

It attempted to send phishing emails from the Mail server.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

Unusually high number of requests to the login page.

Multiple requests with the same X-Requested-With header.

It attempted to perform a SIP Invite Flood on the VOIP server.

This IP belongs to Lowe's.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

The IP attempted to use the FTP server to distribute network mapping tools.

The IP was caught attempting to execute heap overflow attacks.