The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

It attempted to send phishing emails from the Postfix server.

This IP belongs to Deutsche Telecom.

It sent VOIP requests to non-existent extensions.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

GET /login.action: Trying to find a Struts2 application to exploit.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

This IP belongs to FedEx.

This IP belongs to Charter Communications.

We observed the IP distributing harmful document tracking tools.

Participated in malicious pranks by altering messages sent through the server.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

This IP belongs to Costco Wholesale.

It attempted to perform a password spraying attack on the POP3 server.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

This IP belongs to Deere.

This IP belongs to Pfizer.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.