The IP attempted to perform a NetBIOS amplification attack on the SSH server.

This IP belongs to Shopify.

It attempted to perform a credential stuffing attack on the SASL server.

This IP belongs to General Motors.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

It attempted to use the FTP server to distribute traffic monitoring tools.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

Unusual patterns in user agent strings.

This IP belongs to Phillips 66.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

This IP belongs to Dropbox.

The IP attempted to perform a credential stuffing attack on the IMAP server.

A sudden surge in the number of requests per second, indicating an automated process.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

It attempted to send emails from the POP3 server without authorization.

The IP attempted to perform a brute force attack on the SASL server.

The IP attempted to use the Mail server to relay spam to other servers.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

This IP belongs to Lowe's.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

Repeated attempts to alter or delete log files to cover tracks.