Unusually high CPU usage, which can indicate a brute force attack is in progress.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

The IP attempted to use the FTP server to distribute network mapping tools.

This IP belongs to General Electric.

This IP belongs to Exxon Mobil.

The IP under scrutiny has been associated with multiple modem hijackers.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

The IP attempted to mark emails as read on the POP3 server without authorization.

This IP belongs to Costco Wholesale.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

Attempts to access the server using credentials that have been involved in previous security incidents.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

The IP showed unusual patterns in session IDs.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

It attempted to perform a session hijacking attack on the SSH server.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

This IP belongs to Anthem.

The IP attempted to perform a SIPVicious scan on the VOIP server.

Repeated attempts to alter or delete log files to cover tracks.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

This IP belongs to Procter & Gamble.

It appears that this IP was initiating DNSChanger malware attacks on our network.