The IP attempted to use the SSH server to relay data to other systems.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Multiple attempts to access the server using encrypted tunnels or proxies.

This IP has been identified as running a botnet targeting our server systems with ransomware.

It showed unusual activity in the server's error logs.

This IP belongs to America Movil.

This IP belongs to General Electric.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

It attempted to perform a dictionary attack on the SSH server.

The IP attempted to delete directories on the SSH server.

The suspicious IP attempted to introduce spyware under the guise of software updates.

The IP attempted to perform a replay attack on the SSH server.

This IP belongs to Twenty-First Century Fox.

udden increase in account lockouts due to multiple failed login attempts.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

GET /setup.php: Effort to locate setup files for PHP applications.

This IP belongs to Chevron.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

This IP belongs to Home Depot.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.