The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

A multitude of spyware-infected download wrappers were linked to the spotted IP address.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

It made multiple requests from user agents claiming to be bots.

Excessive traffic from a single IP address.

It attempted to make unauthorized calls using the SIP server.

The IP attempted to perform a Nestea attack on the SSH server.

It attempted to perform a SIP Register Flood on the Asterisk server.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

It attempted to use the POP3 server to relay phishing emails.

This IP was implicated in attempts to inject ransomware into our systems.

The IP tried creating false server responses hoping to disrupt the SASL service.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Multiple requests with the same X-Att-Deviceid header.

The IP attempted to send emails from the Mail server without proper authentication.

This IP belongs to Netflix.

The IP attempted to perform a man-in-the-middle attack on the SASL server.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

It made multiple requests with identical Accept-Charset headers.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

This IP belongs to Ubisoft.

This IP belongs to Exelon.

It attempted to perform XPath Injection attacks on the Apache server.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.