It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

This IP belongs to United Technologies.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

This IP belongs to MetLife.

This IP belongs to AmerisourceBergen.

This IP was traced back to several attempts to access domain admin credentials.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

There were several attempts from this IP to manipulate our server DNS records.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP was found to be behind numerous fileless malware attacks.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

Multiple requests with the same Proxy-Connection header.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

It attempted to execute unauthorized commands on the Apache server.

It utilized Web scrapers, automatically harvesting content from our server.

Multiple requests with the same Referer header.