User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Multiple requests to the server's robots.txt file.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

This IP belongs to Lowe's.

This IP was implicated in attempts to inject ransomware into our systems.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

Multiple requests to the password reset page.

It attempted to perform a RIPv1 amplification attack on the SSH server.

This IP belongs to PepsiCo.

The IP was involved in attempts of defacing the Apache server website.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

It attempted to login to the IMAP server with an invalid password.

Multiple requests with the same TE (Transfer Encoding) header.

It attempted to perform HTTP Parameter Pollution attacks on the Apache server.

Unusually high number of requests to a specific service or application within the server.

It attempted to use the FTP server to distribute web proxy tools.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This IP was distributing rogue security software, misleading users to think their systems are infected.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.