It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

It attempted to upload malicious scripts to the Apache server.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

This IP was implicated in attempts to inject ransomware into our systems.

It attempted to use the FTP server to distribute zombie network tools.

Excessive traffic from a single IP address.

The IP sent numerous Asterisk OPTIONS requests in a short time.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

Evidence shows that the IP address has sent a number of deceptive phishing emails to our employees.

Our data indicates this IP has performed data breaches by launching phishing attacks.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

It made multiple requests with the same Referer header.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

This IP belongs to Boeing.

Multiple requests with the same Origin header.

The IP address initiated attacks using DDoS, impacting our server response times.

The IP made multiple requests with the same Proxy-Connection header.

It attempted to perform a Land attack on the SSH server.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

The IP attempted to send spam emails from the Postfix server.

The IP attempted to use the FTP server to distribute keylogging software.

This IP belongs to Microsoft Azure.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.