It attempted to use the FTP server to distribute brute force tools.

The IP under scrutiny has been associated with multiple modem hijackers.

It attempted to perform Web Service attacks on the Apache server.

It attempted to perform a replay attack on the SASL server.

This IP belongs to Travelers Cos.

The IP attempted to perform a DNS amplification attack on the SSH server.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

The IP attempted to perform SOAP Injection attacks on the Apache server.

Our system flagged this IP as conducting fraudulent transactions activities.

Attempts to access the server using unusual HTTP methods or request types.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

It attempted to perform XML Entity Expansion attacks on the Apache server.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

Multiple account lockouts in a short period of time.

It was discovered illicitly scanning the server for potential vulnerabilities.

It attempted to login to the POP3 server with an invalid password.

This particular IP has been used in advanced persistent threats against our servers.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

Repeated attempts to alter or delete log files to cover tracks.