It attempted to use the SIP server to perform a reflection DDoS attack.

The IP attempted to use the FTP server to distribute malware.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

This IP belongs to Allstate.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

This IP belongs to Travelers Cos.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

It attempted to send emails with malicious links from the Mail server.

It was found initiating attack vectors to exploit SSH agent forwarding.

It attempted to use the SASL server to distribute malware.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

Our system flagged this IP as conducting fraudulent transactions activities.

The reported IP was identified as a BadBot, engaging in harmful activities such as unauthorized web scraping and data mining.

This IP belongs to Intel.

This IP belongs to AmerisourceBergen.

The IP address attempted to exploit known vulnerabilities in server software.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

The IP attempted to perform Integer Overflow attacks on the Apache server.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

Multiple requests with the same Max-Forwards header.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.