This IP belongs to BT Central Plus.

GET /../htpasswd: Trying to access password files using directory traversal.

This IP belongs to Goldman Sachs Group.

It attempted to take advantage of misconfigurations in the Apache server.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

The IP engaged in a mail relay attack, using our server to send spam.

GET /setup.php: Effort to locate setup files for PHP applications.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

This IP belongs to DuPont de Nemours.

The IP showed unusual patterns in session IDs.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

The IP attempted to register as a VOIP user with no password.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

Several phishing emails have been traced back to this suspicious IP address.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

It attempted to perform a Teardrop attack on the SSH server.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

The IP made multiple requests with the same Origin header.

It made multiple requests with identical cookies.

This IP belongs to Medium.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

The IP attempted to register with the VOIP server using an invalid username.

Unusually high CPU usage, which can indicate a brute force attack is in progress.