Repeated connections to the server from unknown or suspicious IP addresses.

The IP address attempted to login to the SSH server with an invalid username.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

This IP belongs to Kroger.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.

This IP was linked to an attempt at distributing malicious software within our system.

It attempted to exploit known vulnerabilities in the Postfix software.

It attempted to delete directories on the FTP server.

It attempted to perform a SIP Invite Flood on the VOIP server.

The IP made multiple requests with the same Proxy-Connection header.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

The IP attempted to perform a brute force attack on the SSH server.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

This IP belongs to Citigroup.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

It tried to execute dictionary attacks on our Mail service causing potential delays.

The IP showed unusual patterns in session IDs.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

The IP has been implicated in multiple cases of URL manipulation attempts.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

The IP attempted to perform a man-in-the-middle attack on the SASL server.